feat: cut /legal/privacy/ §Who can see it to four plain statements; name SML Company Ltd on the consent; close Q64 moot
Two rulings from Pouya, 2026-09-02.
(1) The section stays generic — "it over-explains technical mechanics that
belong in the evidence file, not in front of an inquirer." Deleted: the
measurement paragraph, the root-credential sentence, the SSO/federated-login
enumeration, the resource-policy clause, the "company that runs a database"
aside, the deploy-credential sentence and the three-copies summary. All of it
stays true and stays measured in AGENTS.md §7 and the evidence file, which now
maps each shipped sentence to what it rests on.
(2) The consent string names the corporation: "I consent to SML Company Ltd
storing and using the information in this form…". docs/05 §Consent text moves
with it, proven byte-identical. Two new §4 rows carry the attestations the copy
rests on.
(3) The §Who can see it approval closes via the page read-through, which is now
blocker 2 in docs/06's callout rather than a checklist line.
Q64 closes MOOT — the paragraph it was about was deleted, so it gates nothing.
The underlying gap is unchanged: §7 records root as held by Pouya, not held only
by Pouya, and nothing about root custody may be published without asking again.
Two sentences were added back under review: the shared-account disclosure, to
§Where it is stored (a storage disclosure, never named in the ruling — without
it no page said the intake sits in a shared account), and one naming SML Company
Ltd in the policy, because a consent naming a company the linked policy never
mentions is an accountability gap.
adversarial-reviewer, two rounds, 14 findings, all resolved, none declined;
nine of round 2's ten were defects in round 1's own repairs. claims-auditor
correctly deferred to cutover per D20.
Gates, exit status read: check 0 · build 0 (23 pages) · check:claims 0
(12 patterns, 33 approved strings) · check:intake 0 · og:proof 0 · lint 0 ·
lighthouse 0, worst of 23 99/100/100/100. Tripwire proven both ways — exit 0 on
the revised page, exit 1 with 5 matches on the bd282aa bytes. Regex untouched.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5
This commit is contained in:
Pouya Lajevardi
co-authored by
Claude Opus 5
Claude Opus 5
parent
99889a3491
commit
4735989f0b
+12
-4
@@ -146,7 +146,7 @@ might reasonably treat as privileged. The intake call is for that.
|
||||
|
||||
### Consent text
|
||||
|
||||
> I consent to Pouya Lajevardi storing and using the information in this form to
|
||||
> I consent to SML Company Ltd storing and using the information in this form to
|
||||
> respond to my inquiry and to run a conflicts check. I understand that
|
||||
> submitting this form does not create a retainer, does not appoint a neutral,
|
||||
> and does not itself establish a mediator–party relationship.
|
||||
@@ -216,8 +216,16 @@ against this row.
|
||||
| `ttl` | epoch seconds — **the input to automatic deletion; see §Retention for why writing it is not the mechanism** |
|
||||
|
||||
**Encryption at rest** with a customer-managed KMS key. **Point-in-time recovery
|
||||
on.** Table access limited to the Lambda role and one named administrative
|
||||
principal.
|
||||
on.** ⚠️ **THE THIRD LINE HERE WAS *"table access limited to the Lambda role and
|
||||
one named administrative principal"*, AND IT WAS THE Q62 FALSEHOOD — struck
|
||||
2026-09-02.** It is false on both halves: `adr-intake-lambda-role` holds
|
||||
`PutItem` **only** and cannot read the table at all, and access is not one
|
||||
principal. **`AGENTS.md` §7's `Intake table — who can read it` row is the answer
|
||||
and this spec does not restate it** — a duplicated fact is one that goes wrong in
|
||||
the copy nobody re-reads, which is what happened here: the Q62 sweep ran over
|
||||
`src/` and never reached a spec, and `check:claims` carries this exact sentence
|
||||
as a string that reached `dist/`. It survived the sweep this file's own
|
||||
definition-of-done claims to have completed (`adversarial-reviewer`, round 2).
|
||||
|
||||
⚠️ **TWO OF THOSE THREE ARE THE STATE OF THE RUNNING TABLE AND ONE IS NOT.**
|
||||
PITR is **on** `[verified 2026-09-01 — describe-continuous-backups,
|
||||
@@ -446,7 +454,7 @@ Plausible or Fathom, cookieless, no consent banner.
|
||||
- [ ] **TTL set and verified by test record.** ⚠️ **THIS ONE BACKS A PUBLISHED PROMISE.** `/legal/privacy/` states that records are deleted automatically after 24 months, and it asserts the **mechanism**, not only the period. The handler writes the `ttl` attribute — epoch seconds, 24 months, confirmed against this spec `[verified 2026-08-31]` — and **writing the attribute is not the mechanism**: TTL must also be enabled on the table, which is a table setting the code cannot see. **`AGENTS.md` §7 holds that status and its stamp; this line does not restate it** — it restated it once, went stale within the day, and had to be pulled back (§12 R19). **The test record is what closes this item, not the status:** `ENABLED` proves the setting, a record written with a near-future `ttl` and observed to vanish proves the behaviour. Tracked as §9 Q60
|
||||
- [x] **PITR enabled** — `ENABLED`, 35-day window `[verified 2026-09-01 — describe-continuous-backups]`
|
||||
- [ ] KMS customer-managed key. **Not on the table: encryption at rest is with the AWS-owned key** `[verified 2026-09-01 — describe-table returns no SSEDescription]`. **Not claimed on `/legal/privacy/`** — the page says "encrypted at rest", which is unconditionally true of every DynamoDB table and does not mention a customer-managed key, so nothing published depends on it. An improvement, not a blocker
|
||||
- [x] ✅ **Table access matches what `/legal/privacy/` says about it — 2026-09-02.** **The access is unchanged; the page now states it.** Pouya ruled *state the truth* rather than *remove the access* (§9 Q62), so the page attributes read access to **the account's administrators of a shared account, with no human headcount** — the count came off later the same day under §9 Q63, because a simulation counts identities and the page was reading them as people — and adds the two stronger facts the false sentence had crowded out: the handler role holds `PutItem` **only**, and `adr-sml-deploy` is `implicitDeny` on all seven read **and** write actions. Evidence and commands: `docs/reference/intake-table-access-verification.md`, whose enumeration was **extended on 2026-09-02** — the original screened roles by `list-attached-role-policies` alone, missing that 23 of 26 non-service-linked roles carry inline policies and that the two CDK `lookup` roles can read the table. Four roles can, not two; every one of them is reachable only by those administrators. ⚠️ **Do not restate that as a count of PEOPLE** — this line said *"all four terminate at the same two people"* until 2026-09-02, which is the inference §9 Q63 struck. ⚠️ **THIS LINE SAID "IT DOES NOT" FOR A DAY AFTER THE PAGE WAS CORRECTED, AND IT IS A DEFINITION-OF-DONE LIST SOMEONE FOLLOWS AT CUTOVER** — the Q62 sweep was run over `src/` only, so it could not reach a spec. `adversarial-reviewer`, round 1. The sweep across `docs/` is in the Change Log entry
|
||||
- [x] ✅ **Table access matches what `/legal/privacy/` says about it — 2026-09-02.** **The access is unchanged; the page now states it.** Pouya ruled *state the truth* rather than *remove the access* (§9 Q62), so the page states the truth about access rather than a false exclusivity. ⚠️ **WHAT IT STATES CHANGED TWICE MORE THAT DAY AND THIS LINE IS WRITTEN AGAINST THE SHIPPED BYTES, NOT AGAINST THE RULING.** §9 Q63 took the human headcount off (a simulation counts identities and the page was reading them as people), and a second ruling then cut §Who can see it to **four plain statements**. The page now says: *"The record in the table: me, and the small number of people who administer the account it sits in with me"*; that the receiving system *"can only add a record — it cannot read back what is stored"*; where the notification goes and who reads it; and that the confirmation sits with the reader's own provider. **§Where it is stored carries the shared-account disclosure** — *"an Amazon Web Services account that also runs systems unrelated to this practice"*. ⚠️ **`adr-sml-deploy` is `implicitDeny` on all seven read AND write actions — MEASURED, TRUE, AND NO LONGER ON THE PAGE**; it went with the mechanics cut and it is §7's claim now, not the policy's. Do not tick this item against a page that states it. Evidence and commands: `docs/reference/intake-table-access-verification.md`, whose enumeration was **extended on 2026-09-02** — the original screened roles by `list-attached-role-policies` alone, missing that 23 of 26 non-service-linked roles carry inline policies and that the two CDK `lookup` roles can read the table. Four roles can, not two; every one of them is reachable only by those administrators. ⚠️ **Do not restate that as a count of PEOPLE** — this line said *"all four terminate at the same two people"* until 2026-09-02, which is the inference §9 Q63 struck. ⚠️ **THIS LINE SAID "IT DOES NOT" FOR A DAY AFTER THE PAGE WAS CORRECTED, AND IT IS A DEFINITION-OF-DONE LIST SOMEONE FOLLOWS AT CUTOVER** — the Q62 sweep was run over `src/` only, so it could not reach a spec. `adversarial-reviewer`, round 1. The sweep across `docs/` is in the Change Log entry
|
||||
- [ ] Both emails send; SPF/DKIM/DMARC aligned; inbox-tested, not spam-tested
|
||||
- [ ] **CloudWatch alarms on Lambda `Errors` and API Gateway `5xx`** — replacing the DLQ item, which is struck: a DLQ on a **synchronously** invoked function never receives anything, so the alarm on its depth would have been permanently green. See §Notification. The handler writes to DynamoDB **before** sending mail, so the protection this item was pointing at is in the code rather than in a queue
|
||||
- [x] **Form usable by keyboard only.** Errors are announced by the browser's own validation, which with no script is the only thing that can announce them inline — `role="alert"` needs a live region and something to write into it
|
||||
|
||||
+134
-91
@@ -396,18 +396,23 @@ Then invalidate `/*`.
|
||||
> deployment takes.
|
||||
|
||||
> 🛑 **TWO THINGS BLOCK THIS ENTIRE LIST AS AT 2026-09-02: ONE WAITING PERIOD
|
||||
> AND ONE LINE FROM POUYA.**
|
||||
> AND ONE READ-THROUGH.**
|
||||
>
|
||||
> ⚠️ *(The count has moved twice in one day and the DIRECTION is what to read.
|
||||
> It said ONE for part of 2026-09-02 and that was a **defect** — the wording
|
||||
> approval Pouya reserved had been recorded only inside records marked closed,
|
||||
> the `TODO(pouya)` deleted, Q62 struck, this callout ticked, so nothing would
|
||||
> have stopped unapproved copy publishing (`adversarial-reviewer`, D20 pass
|
||||
> round 1). Q63 was then **answered** in three limbs by ruling, which is a gate
|
||||
> closed by an answer rather than by deletion. Answering it opened **Q64**, one
|
||||
> paragraph lower on the same page. **A question that closes and a question that
|
||||
> is deleted look identical in a count and nowhere else, which is why the count
|
||||
> is never the record.**)*
|
||||
> ⚠️ *(The count has moved repeatedly in one day and the DIRECTION is the only
|
||||
> part worth reading — the number of moves is deliberately not stated, because a
|
||||
> tally of how often a tally changed is the same trap one level up. It said ONE for part of 2026-09-02 and that was a
|
||||
> **defect** — the wording approval Pouya reserved had been recorded only inside
|
||||
> records marked closed, the `TODO(pouya)` deleted, Q62 struck, this callout
|
||||
> ticked, so nothing would have stopped unapproved copy publishing
|
||||
> (`adversarial-reviewer`, D20 pass round 1). Q63 was then **answered** in three
|
||||
> limbs by ruling, which is a gate closed by an answer rather than by deletion —
|
||||
> and answering it **opened Q64**, one paragraph lower on the same page. Q64 then
|
||||
> left the list a **third** way: **the paragraph it was about was deleted**, so
|
||||
> the question is moot rather than answered. **Closed, deleted, and moot look
|
||||
> identical in a count and nowhere else, which is why the count is never the
|
||||
> record.** The second slot is no longer a question at all — it is the human
|
||||
> pass, promoted here from the checklist below because that is where the last
|
||||
> reserved approval went missing.)*
|
||||
>
|
||||
> 1. **Q60 — the retention MECHANISM has still not been observed.** TTL is
|
||||
> `ENABLED` and no record has been watched to disappear, and
|
||||
@@ -416,15 +421,23 @@ Then invalidate `/*`.
|
||||
> record is written and it does not call failure before **7 days**, so
|
||||
> **start it before anything else on this page.** It is the one blocker
|
||||
> that is a waiting period rather than a task.
|
||||
> 2. **Q64 — does anyone else hold the AWS root password or its MFA device?**
|
||||
> `/legal/privacy/` publishes *"has no programmatic key, and I hold it"* — his
|
||||
> own words from the Q63(c) ruling, **true whether or not someone else holds
|
||||
> it too**, sitting one paragraph below *"the small number of people who
|
||||
> administer it with me"*, where a reader takes it as **sole** custody. Root
|
||||
> cannot be simulated, so nothing establishes that either way. **One line
|
||||
> settles it:** sole custody → say so, record it in §7, arm §12 R21; not sole
|
||||
> → the possessive comes out and the sentence keeps its measured half. See the
|
||||
> unticked item under **Copy and claims** below.
|
||||
> 2. **Pouya has not yet read every page against `AGENTS.md` §4.** The human
|
||||
> pass — the other half of D20, and not delegable. **It is also where the
|
||||
> §Who can see it approval now lands:** Pouya ruled on 2026-09-02 that the
|
||||
> read-through *is* the approval and that nothing is to be held open waiting
|
||||
> on a separate wording sign-off. The item under **Copy and claims** below
|
||||
> carries what to read first and why.
|
||||
>
|
||||
> ✅ **CLOSED 2026-09-02 — Q64, MOOT.** It asked whether anyone else holds the
|
||||
> AWS root password or its MFA device, because the page published *"has no
|
||||
> programmatic key, and I hold it"* one paragraph below *"the small number of
|
||||
> people who administer it with me"*, where a reader takes it as **sole**
|
||||
> custody. **Pouya's second ruling that day deleted the sentence** — the section
|
||||
> is now four plain statements and says nothing about root — so the question no
|
||||
> longer gates anything. ⚠️ **The underlying fact is unchanged and unestablished:
|
||||
> §7 records root as *held by Pouya*, which is not *held only by Pouya*, and
|
||||
> nothing measured can settle it. Nothing may be published about root custody
|
||||
> without asking again.**
|
||||
>
|
||||
> ✅ **CLOSED 2026-09-02 — Q63, all three limbs, by ruling.** **(a)** The §Who
|
||||
> can see it wording is **approved with two trims** — the editorial closing
|
||||
@@ -439,15 +452,54 @@ Then invalidate `/*`.
|
||||
> humans**. No numeric human headcount ships; the page attributes read access to
|
||||
> *"the account's administrators — me, and the small number of people who
|
||||
> administer it with me"*. §12 **R21** is re-scoped to match.
|
||||
> ⚠️ *(Superseded the same day in its details, not in its rulings: the ruling
|
||||
> below cut the section to four plain statements, so the sentence quoted above is
|
||||
> no longer the shipped one and root is not mentioned at all. Each limb of Q63
|
||||
> still stands — no headcount, the mailbox named, root attested in §7.)*
|
||||
>
|
||||
> ✅ **CLOSED 2026-09-02 — THE SECTION IS GENERIC, by a second ruling the same
|
||||
> day.** *"It over-explains technical mechanics that belong in the evidence file,
|
||||
> not in front of an inquirer."* §Who can see it is now **four short statements**
|
||||
> — who can read it, that the receiving system can only add a record, where the
|
||||
> notification goes and who reads it, and that the confirmation sits with the
|
||||
> reader's own provider. **Deleted from §Who can see it:** the measurement
|
||||
> paragraph, the root-credential sentence, the single-sign-on and federated-
|
||||
> login enumeration, the resource-policy clause, the *"company that runs a
|
||||
> database"* aside, the deploy-credential sentence and the three-copies
|
||||
> summary. ⚠️ **THE SHARED-ACCOUNT CLAUSE WAS CUT WITH THEM AND THEN RESTORED
|
||||
> — to §Where it is stored, where it belongs.** It is a storage disclosure
|
||||
> rather than mechanics, the ruling did not name it, and without it no page
|
||||
> told a reader their intake sits in an account that also runs unrelated
|
||||
> systems (`adversarial-reviewer`, round 1). **These lists must stay identical
|
||||
> — there were four of them and they named four different sets.** **None of
|
||||
> that verified
|
||||
> material was lost** — all of it stays in `AGENTS.md` §7 and
|
||||
> `docs/reference/intake-table-access-verification.md`, and the section comment in
|
||||
> `src/pages/legal/privacy.astro` bars restoring it to the page. **The risk moved
|
||||
> in the right direction:** every deleted sentence was a claim about a system
|
||||
> outside this repository that nothing reports on, which is what §12 **R21**
|
||||
> exists for — R21 is re-scoped from five live claims to two.
|
||||
>
|
||||
> ✅ **CLOSED 2026-09-02 — THE CONSENT STRING NAMES THE CORPORATION.** *"I
|
||||
> consent to **SML Company Ltd** storing and using the information in this
|
||||
> form…"*, per ruling, replacing the natural person. It is the one sentence a
|
||||
> submitter actually agrees to and it is the PIPEDA basis, and the policy it
|
||||
> links to describes a mailbox read by administrative staff — a corporation is
|
||||
> the party that matches, and `/legal/privacy/` now names it in terms under §Why
|
||||
> it is collected. **The NAME ONLY:**
|
||||
> §4 verifies the federal incorporation, records it as *not published*, and
|
||||
> cautions that it must never be read beside the licence-status row. `docs/05`
|
||||
> §Consent text carries the string verbatim and moved with it.
|
||||
>
|
||||
> ✅ **CLOSED 2026-09-02 — Q62.** `/legal/privacy/` no longer states anything
|
||||
> false about who can read the intake table. Pouya's ruling was **state the
|
||||
> truth**, not remove the second administrator's access: the page attributes read
|
||||
> access to the account's administrators, names their role, and adds the two
|
||||
> stronger facts the false sentence had been crowding out — the writing function
|
||||
> cannot read the table, and the deploy credential has no access to it at all.
|
||||
> *(It said "two people can read it" until the Q63 ruling later the same day
|
||||
> replaced the count; see the Q63 block above.)* The
|
||||
> access to the account's administrators and names their role. *(It said "two
|
||||
> people can read it" until the Q63 ruling later the same day replaced the count,
|
||||
> and the ruling after that cut the section to four plain statements — of the two
|
||||
> stronger facts this entry originally credited it with, the writing function's
|
||||
> add-only access still ships and the deploy credential's lack of access does
|
||||
> not. See the two blocks above.)* The
|
||||
> `sole-administrator-q62` tripwire in `check-claims.mjs` **stays permanently**
|
||||
> by the same ruling, extended from two alternatives to **five**: the clause the
|
||||
> first form could not see two sections up the same page, the summary that would
|
||||
@@ -554,52 +606,35 @@ the decision is re-readable rather than re-litigated.
|
||||
have flagged correct copy and demanded the struck form. It read §4 instead.
|
||||
That is the fifth stale claim found in that file and it is not the agent's
|
||||
to fix
|
||||
- [x] ✅ **Q63(a) RULED 2026-09-02 — the wording is approved WITH TWO TRIMS.**
|
||||
The editorial closing sentence (*"I would rather tell you that than give
|
||||
you the tidier answer"*) is struck, and the mailbox clause is rewritten per
|
||||
(b). Q62's ruling settled what the section must **say**; he reserved the
|
||||
**wording**, and that reservation is discharged by the ruling. **This tick
|
||||
records the RULING, not the current text** — see the next item.
|
||||
- [ ] 🛑 **THE §Who can see it TEXT AS IT NOW STANDS HAS NOT BEEN READ BY POUYA,
|
||||
AND IT IS NOT THE TEXT HE APPROVED.** The same ruling that approved the
|
||||
wording also took the human headcount off the page, and the two review
|
||||
rounds that followed rewrote both paragraph openings, the root sentence and
|
||||
the mailbox clause. **The revised section is quoted verbatim in
|
||||
`docs/reference/intake-table-access-verification.md`** for exactly this
|
||||
reading. ⚠️ **This item is split from the one above because a single ticked
|
||||
box over changed copy is the defect the item above was created to stop** —
|
||||
a person working this list reads the tick, not the eleven lines under it
|
||||
(`adversarial-reviewer`, round 2). It is narrower than the general
|
||||
read-through below: this one is the wording approval Pouya reserved in
|
||||
terms, over the sentences that actually ship.
|
||||
⚠️ **THIS ITEM EXISTS BECAUSE THE GATE HAD NO MECHANISM.** On 2026-09-02
|
||||
the `TODO(pouya)` was deleted from the source, Q62 was struck in §9 and the
|
||||
blocker in the callout above was ticked — all correctly, and the net effect
|
||||
was that the only surviving record of an **open** approval requirement was
|
||||
prose inside three records marked ✅ CLOSED. When Q60's TTL test passes,
|
||||
nothing mechanical or visual would have stopped copy Pouya has not read.
|
||||
`adversarial-reviewer`, D20 pass round 1. ⚠️ **THAT SENTENCE READ "the
|
||||
`TODO(pouya)` is reinstated beside the copy and §9 Q63 is open" AFTER BOTH
|
||||
HAD BEEN CLOSED IN THE SAME CHANGE SET** — a ticked item describing a live
|
||||
control that no longer existed, which is Q22's shape on the item written to
|
||||
stop Q22's shape (`adversarial-reviewer`, round 1). **What actually carries
|
||||
the text as it now stands:** the read-through item below, and §9 **Q64**
|
||||
with its own `TODO(pouya)` and its own unticked item — because answering
|
||||
Q63 opened Q64 rather than clearing the section
|
||||
- [ ] 🛑 **DOES ANYONE ELSE HOLD THE AWS ROOT PASSWORD OR ITS MFA DEVICE —
|
||||
§9 **Q64**.** `/legal/privacy/` publishes *"Its root credential — the one
|
||||
path no policy constrains — has no programmatic key, and I hold it"*.
|
||||
Those are Pouya's own words from the Q63(c) ruling and they are **true
|
||||
whether or not a second person holds it**; the defect is what a reader
|
||||
takes from them, one paragraph below *"the small number of people who
|
||||
administer it with me"*. Root is not an IAM principal and cannot be
|
||||
simulated, so no measurement settles it — `get-account-summary` gives only
|
||||
`AccountAccessKeysPresent: 0` and `AccountMFAEnabled: 1`. **Sole custody →
|
||||
say so on the page, record it in §7, arm §12 R21. Not sole → strike the
|
||||
possessive and keep the measured half.** `src/pages/legal/privacy.astro`
|
||||
carries the `TODO(pouya)`. **This is Q63's lesson pointing the other way**:
|
||||
Q63 struck a sentence for reading identities as people; this one invites a
|
||||
reader to read a possessive as an exclusion
|
||||
- [x] ✅ **THE §Who can see it WORDING APPROVAL IS DISCHARGED — Pouya's ruling,
|
||||
2026-09-02: *"the read-through is the approval."*** Q62 settled what the
|
||||
section must **say** and he reserved the **wording**; he then ruled twice on
|
||||
it the same day — Q63(a) approving with two trims, and the second ruling
|
||||
cutting the section to four plain statements — and directed in terms that
|
||||
nothing be held open waiting on a separate sign-off. ⚠️ **THIS TICK IS NOT
|
||||
"THE TEXT HAS BEEN READ".** It records that the reserved approval has
|
||||
**moved**, to the read-through blocker in the callout above and the item
|
||||
below. Two ticked boxes stood here for one round — one for the ruling, one
|
||||
for the text — because a single tick over changed copy is how an approval
|
||||
requirement went missing the first time (`adversarial-reviewer`, round 2).
|
||||
They collapse into this one only because the ruling collapsed them, and
|
||||
the gate did not disappear: **it is blocker 2 in the callout above**, which
|
||||
is the most-read place on this page rather than the least.
|
||||
- [x] ✅ **CLOSED 2026-09-02 — Q64 IS MOOT: THE PARAGRAPH WAS DELETED.** It asked
|
||||
whether anyone else holds the AWS root password or its MFA device, because
|
||||
`/legal/privacy/` published *"has no programmatic key, and I hold it"* one
|
||||
paragraph below *"the small number of people who administer it with me"* —
|
||||
where a reader takes it as **sole** custody, which nothing establishes.
|
||||
Pouya's second ruling that day struck the sentence along with the rest of
|
||||
the mechanics, so no page says anything about root and the question gates
|
||||
nothing. The `TODO(pouya)` is gone from
|
||||
`src/pages/legal/privacy.astro` with the paragraph that carried it.
|
||||
⚠️ **THE FACT IS STILL UNESTABLISHED AND THAT DID NOT CHANGE.** §7 records
|
||||
root as *held by Pouya*, which is not *held only by Pouya*; root is not an
|
||||
IAM principal and cannot be simulated. **Nothing about root custody may be
|
||||
published without asking him again** — the section comment in the page
|
||||
source carries that bar, because "we deleted it" and "we checked it" are
|
||||
the same green tick from three weeks away.
|
||||
- [x] ✅ **Q63(b) ANSWERED 2026-09-02 — `info@smlcompany.ca` is a DELEGATED
|
||||
MAILBOX: Pouya and administrative staff read it.** The page said *"anyone
|
||||
who can reach that mailbox"*, which was true either way and answered the
|
||||
@@ -618,12 +653,17 @@ the decision is re-readable rather than re-litigated.
|
||||
- [ ] **Pouya has read every page against `AGENTS.md` §4.** The human pass. It is
|
||||
the other half of D20 and it is not delegable — his reading is what the
|
||||
per-step audit was traded for.
|
||||
⚠️ **START WITH `/legal/privacy/` §Who can see it.** Every sentence in it
|
||||
changed on 2026-09-02, twice — once by Q62's ruling and again by Q63's —
|
||||
and it is the only section on the site whose subject lives entirely outside
|
||||
this repository. It is also where the approval he reserved lands: Q63(a)
|
||||
approved the wording, and the wording then changed under the same ruling
|
||||
when the headcount came out.
|
||||
⚠️ **START WITH `/legal/privacy/` §Who can see it. IT IS BLOCKER 2 IN THE
|
||||
CALLOUT ABOVE, AND THIS READ *IS* THE APPROVAL** — Pouya ruled on
|
||||
2026-09-02 that nothing waits on a separate wording sign-off. Every
|
||||
sentence in it changed three times that day — Q62's ruling, Q63's, then the
|
||||
ruling that cut it to **four plain statements** — and it is the only
|
||||
section on the site whose subject lives entirely outside this repository.
|
||||
**It is now four sentences and should take a minute**; that is the point of
|
||||
the cut. The verified material behind them is in
|
||||
`docs/reference/intake-table-access-verification.md` and `AGENTS.md` §7 if
|
||||
he wants to check any of it, and **the page deliberately no longer cites
|
||||
it**.
|
||||
**Then read the two `/contact/` sentences against it, which is a judgement
|
||||
rather than a defect** — `/contact/received/` says *"email me directly at
|
||||
`info@smlcompany.ca` — that reaches me whether or not the receipt did"* and
|
||||
@@ -634,20 +674,23 @@ the decision is re-readable rather than re-litigated.
|
||||
the neutral may take more from the word than is true. A sweep of all 23
|
||||
built pages found these two as the only other surfaces touching the point.
|
||||
Raised as **consider**, not blocking, by `adversarial-reviewer` round 1.
|
||||
⚠️ **AND A THIRD SURFACE THAT SWEEP COULD NOT REACH — the CONSENT string,
|
||||
`src/data/intake.ts`, rendered on `/contact/`:** *"I consent to **Pouya
|
||||
Lajevardi** storing and using the information in this form…"*. It names a
|
||||
natural person as the party storing and using the data, while the policy it
|
||||
links to now describes the practice's mailbox, administrative staff and a
|
||||
shared AWS account. **Nothing here is false** — he is the accountable
|
||||
individual and staff act for him — but it is the one sentence a submitter
|
||||
actually agrees to, and it is the PIPEDA basis. **The sweep that missed it
|
||||
was anchored on mailbox vocabulary** (*"email me directly"*, *"reaches
|
||||
me"*), which is R8's sharpest edge: the right command, the wrong anchor.
|
||||
**Decide it here rather than leaving it implicit** — either widen the
|
||||
consent, or record that it names the responsible individual deliberately.
|
||||
Either way the consent string joins the surfaces the mailbox question
|
||||
governs, so the next answer reaches it. `adversarial-reviewer`, round 2.
|
||||
✅ **THE THIRD SURFACE IS DECIDED — the CONSENT string now names the
|
||||
corporation.** *"I consent to **SML Company Ltd** storing and using the
|
||||
information in this form…"*, Pouya's ruling 2026-09-02, replacing the
|
||||
natural person. It is the one sentence a submitter actually agrees to and
|
||||
it is the PIPEDA basis, and the policy it links to describes a mailbox read
|
||||
by administrative staff — a corporation is the party that matches, and
|
||||
`/legal/privacy/` now names it in terms under §Why it is collected. **The sweep that had missed it was anchored on
|
||||
mailbox vocabulary** (*"email me directly"*, *"reaches me"*), which is R8's
|
||||
sharpest edge: the right command, the wrong anchor.
|
||||
⚠️ **THE PAGE AROUND IT STILL SAYS "me" AND "I", AND THAT IS DELIBERATE, NOT
|
||||
AN OVERSIGHT — read the two together and say if it reads wrong.** The
|
||||
ruling changed the consent sentence and nothing else; `/legal/privacy/` is
|
||||
written in the first person throughout (*"whatever you send me"*, *"in your
|
||||
hands rather than mine"*), and `/contact/` is too. Nothing is false either
|
||||
way — he is the accountable individual, the corporation holds the systems —
|
||||
but the checkbox and the prose beside it now name different parties, and
|
||||
**that is a judgement about voice which is his and not a reviewer's.**
|
||||
- [x] ✅ **MEMBERSHIPS RE-CONFIRMED 2026-09-02 — Pouya: ADRIC, ADRIO, the three
|
||||
OBA sections and the CTF are all current.** §4 and `src/data/site.ts` are
|
||||
re-stamped `[verified 2026-09-02 — Pouya]`. ⚠️ **THERE ARE TWO ARRAYS AND
|
||||
|
||||
@@ -41,38 +41,63 @@ exact count. **No numeric human headcount may ship.** The identity counts in thi
|
||||
file are unaffected and stay exactly as measured — this is a correction to what
|
||||
may be *concluded* from them, not to any of them.
|
||||
|
||||
⚠️ **AND RULED A THIRD TIME, LATER THE SAME DAY: THE PAGE STATES WHO, AND THIS
|
||||
FILE HOLDS THE METHOD.** Pouya, 2026-09-02: *"the page stays generic. It
|
||||
over-explains technical mechanics that belong in the evidence file, not in front
|
||||
of an inquirer."* §Who can see it is now **four short statements**. **Deleted from
|
||||
the page:** the measurement paragraph, the root-credential sentence, the single-sign-on and federated-login enumeration, the resource-policy clause, the *"company that runs a database"* aside, the deploy-credential sentence and the three-copies summary. ⚠️ **THE SHARED-ACCOUNT CLAUSE WAS CUT WITH THEM AND THEN RESTORED — to §Where it is stored, where it belongs.** It is a storage disclosure rather than mechanics, the ruling did not name it, and without it no page told a reader their intake sits in an account that also runs unrelated systems (`adversarial-reviewer`, round 1). **These lists must stay identical — there were four of them and they named four different sets.** None of that was retracted and none of it is lost — it
|
||||
is all still below, unchanged, and **that is now this file's job rather than a
|
||||
supporting role.** ⚠️ **THE PAGE NO LONGER CITES THIS FILE'S CONTENT, SO THE
|
||||
COMPARISON BELOW IS THE ONLY THING TYING THE TWO TOGETHER. Keep it in sync, and
|
||||
do not restore a deleted sentence to the page on the strength of finding it
|
||||
here** — the section comment in `src/pages/legal/privacy.astro` carries the same
|
||||
bar.
|
||||
|
||||
**The shipped sentences as at 2026-09-02**, so this file can be compared against
|
||||
the live page rather than against a struck one:
|
||||
the live page rather than against a struck one. All four, in order, complete:
|
||||
|
||||
> The account's administrators can — me, and the small number of people who
|
||||
> administer it with me. The table sits in an Amazon Web Services account that
|
||||
> also runs systems unrelated to this practice, and administrative access to that
|
||||
> account carries the ability to read the table. That is who can read the stored
|
||||
> record; who reads the notification email is a separate question, answered in the
|
||||
> last paragraph of this section.
|
||||
> The record in the table: me, and the small number of people who administer the
|
||||
> account it sits in with me.
|
||||
|
||||
> The access itself is measured rather than assumed: every user and every role in
|
||||
> the account was simulated against this table, and every identity that comes back
|
||||
> able to read it is reachable only by those administrators. The account has no
|
||||
> single sign-on and no federated login configured, and the table carries no
|
||||
> policy of its own granting access to anyone. The account's root credential — the
|
||||
> one path no policy constrains — has no programmatic key, and I hold it.
|
||||
> The system that receives what you send **can only add a record — it cannot read
|
||||
> back what is stored.**
|
||||
|
||||
> The function that receives the form **can only add a record — it cannot read
|
||||
> the table back.** And the credential that publishes this website has **no
|
||||
> access to the table at all**, for reading or for writing.
|
||||
> The notification goes to the practice's mailbox, which is read by me and by
|
||||
> administrative staff and is hosted on Google Workspace — so Google holds a copy
|
||||
> of whatever you send me.
|
||||
|
||||
**The wording was approved by Pouya on 2026-09-02 with two trims** (§9 Q63(a)) —
|
||||
the editorial closing sentence struck, and the mailbox clause rewritten because
|
||||
`info@smlcompany.ca` is **a delegated mailbox read by Pouya and administrative
|
||||
staff**, not a personal one (Q63(b); the fact is in `AGENTS.md` §7). **`33` was
|
||||
deliberately not published**: a role total moves when AWS creates a service-linked
|
||||
role by itself, and *"every user and every role in the account"* carries the
|
||||
exhaustiveness without putting a second self-staling number on a legal page.
|
||||
> The confirmation that went to you sits with whoever runs your email. That copy
|
||||
> is in your hands rather than mine.
|
||||
|
||||
⚠️ **AND THE ENUMERATION BELOW WAS NOT ENOUGH TO SUPPORT THE SECOND OF THOSE
|
||||
SENTENCES. See the addendum at the foot of this file**, which is what the page
|
||||
actually rests on. Read it before citing the five-row table.
|
||||
**What each rests on, because that mapping is the reason this file exists.**
|
||||
Sentence 1: the enumeration below, plus Pouya's *"a handful"* attestation for the
|
||||
human quantifier — **the measurement gives administrators, the attestation gives
|
||||
the number, and neither gives the other.** Sentence 2: `adr-intake-lambda-role`
|
||||
holds `PutItem` only, implicitDeny on all six read and modify actions.
|
||||
Sentence 3: **an attestation, not a measurement** — `AGENTS.md` §7's
|
||||
`info@smlcompany.ca` row; nothing in this repository or in AWS can check it.
|
||||
Sentence 4: the handler's second `SendEmailCommand`.
|
||||
|
||||
**Three things the page deliberately does NOT say, and each was deleted by
|
||||
ruling rather than being unsupported.** The **root credential** (§7 records it as
|
||||
held by Pouya with no access key and MFA on — ⚠️ *held*, not *held only*, which
|
||||
is why publishing it needed a question and why §9 Q64 is closed as **moot** and
|
||||
not as answered). The **single-sign-on and resource-policy findings**. And the
|
||||
**`33`** — deliberately withheld even while the paragraph stood, because a role
|
||||
total moves when AWS creates a service-linked role by itself.
|
||||
|
||||
**The wording approval Pouya reserved is discharged by the read-through** — his
|
||||
ruling, 2026-09-02: *"do not hold anything open waiting on a separate wording
|
||||
approval; the read-through is the approval."* Q63(a) had approved a version, and
|
||||
the version changed twice after it.
|
||||
|
||||
⚠️ **AND THE ENUMERATION BELOW WAS NOT ENOUGH TO SUPPORT THE COMPLETENESS CLAIM
|
||||
— *"every user and every role in the account was simulated against this table"*,
|
||||
which §7 still asserts and the page no longer carries. See the addendum at the
|
||||
foot of this file**, which is what that claim actually rests on. Read it before
|
||||
citing the five-row table. *(This pointer said "the second of those sentences"
|
||||
until 2026-09-02: it indexed the quote block by POSITION, and the block changed
|
||||
length under it. Name the claim, not its ordinal.)*
|
||||
|
||||
---
|
||||
|
||||
@@ -211,10 +236,19 @@ a silently-skipped iteration is visible as a missing row, and suppresses nothing
|
||||
|
||||
## ⚠️ ADDENDUM 2026-09-02 — THE ENUMERATION ABOVE WAS INCOMPLETE IN THREE WAYS, AND ITS CONCLUSION SURVIVES ANYWAY
|
||||
|
||||
**Why this addendum exists.** `/legal/privacy/` publishes a completeness claim
|
||||
about who can read this table — the second of the three sentences quoted at the
|
||||
top of this file, under **The shipped sentences**. Written as it stood, this file
|
||||
did not support it.
|
||||
**Why this addendum exists.** `/legal/privacy/` published a completeness claim
|
||||
about who can read this table — *"every user and every role in the account was
|
||||
simulated against this table"* — and, written as it stood, this file did not
|
||||
support it. ⚠️ **THAT SENTENCE IS NO LONGER ON THE PAGE**: Pouya ruled later the
|
||||
same day that the section states who and not how, and the measurement paragraph
|
||||
was deleted (see **The shipped sentences** at the top of this file, which is now
|
||||
four statements and does not include it). **This addendum is not thereby
|
||||
obsolete — it is now load-bearing in a different place.** `AGENTS.md` §7's
|
||||
`Intake table — who can read it` row still asserts the completeness, `docs/06`
|
||||
and §12 **R21** still instruct an operator to re-run it before cutover, and the
|
||||
page's first sentence still rests on its conclusion even though it no longer
|
||||
recites the method. **A claim moved off a public page into a register is still a
|
||||
claim.**
|
||||
|
||||
*(This paragraph quoted a different sentence until 2026-09-02 — round 1's
|
||||
**pre-fix** wording, *"every account and role in this infrastructure…"*, which
|
||||
@@ -234,7 +268,7 @@ construction even when it happens to be true.
|
||||
2. **No role was ever simulated against the table.** Access was inferred from
|
||||
policy *names* (`AdministratorAccess`) rather than measured as a decision.
|
||||
3. **The five users were simulated for reads only** — `GetItem`, `Query`, `Scan`.
|
||||
So the page's *"the credential that publishes this website has no access to the
|
||||
So the page's *(then-shipped; deleted by the mechanics ruling of 2026-09-02 and now §7's alone)* *"the credential that publishes this website has no access to the
|
||||
table at all"* covered three read actions and said "at all".
|
||||
|
||||
**What the measurement found, and it changes the role count.** Simulating all 26
|
||||
@@ -351,44 +385,50 @@ always read the table. Two facts bound it: `get-account-summary` reports
|
||||
and `AccountMFAEnabled: 1`. Root access therefore requires the root password and
|
||||
its MFA device.
|
||||
|
||||
⚠️ **THIS PASSAGE SAID *"The page does not mention root and should not"*, AND
|
||||
THAT JUDGEMENT IS SUPERSEDED — §9 Q63(c), 2026-09-02.** It was reasoned from its
|
||||
own last clause: *"Who holds the root credentials is not established in this
|
||||
repository."* **Pouya established it on 2026-09-02: he holds it**
|
||||
`[verified 2026-09-02 — Pouya]`. With the holder known, mentioning root
|
||||
**strengthens** the paragraph rather than opening a hole in it — it closes the
|
||||
one path a careful reader would ask about after being told every user and every
|
||||
role was simulated. The page now states that the root credential has no
|
||||
programmatic key and that he holds it; it does not state a headcount for it, and
|
||||
`AGENTS.md` §7 carries the fact with §12 R21's trigger on it. ⚠️ **AND THE
|
||||
ATTESTATION IS *held by Pouya*, NOT *held ONLY by Pouya* — §9 Q64 is open on
|
||||
exactly that gap.** Nothing here excludes a second holder: root cannot be
|
||||
simulated, and `get-account-summary` reports only that there is no access key and
|
||||
that MFA is on. The shipped possessive sits one paragraph below *"the small
|
||||
number of people who administer it with me"*, where a reader takes it as sole
|
||||
custody. **This is the identity/human error of Q63 pointing the other way** — one
|
||||
line from Pouya either arms it or strikes the possessive. The rest of the
|
||||
original reasoning holds and is why the sentence is still scoped the way it is:
|
||||
an account owner's own credential is inherent to every cloud account and is not a
|
||||
third party who has been granted access, which is why the shipped sentence is
|
||||
scoped to *"every user and every role"* and to who has been *granted* access
|
||||
rather than to a bare "nobody else can".
|
||||
⚠️ **THE PAGE SAYS NOTHING ABOUT ROOT, AND THIS PASSAGE HAS NOW BEEN THE REASON
|
||||
FOR THAT TWICE ON OPPOSITE GROUNDS.** It first read *"The page does not mention
|
||||
root and should not"*, reasoned from its own last clause — *"who holds the root
|
||||
credentials is not established in this repository."* **Pouya then established it
|
||||
(§9 Q63(c), 2026-09-02): he holds it** `[verified 2026-09-02 — Pouya]`, the page
|
||||
published *"has no programmatic key, and I hold it"*, and the gap that opened
|
||||
immediately was that *held by* is not *held only by* — a reader takes the
|
||||
possessive as sole custody, which nothing measured or attested supports (§9
|
||||
**Q64**). **His second ruling that day deleted the sentence** along with the rest
|
||||
of the mechanics, so **Q64 is closed as MOOT rather than answered and the
|
||||
underlying fact is exactly as unestablished as it was.**
|
||||
|
||||
**Two page sentences are now supported that were not before.**
|
||||
**The consequence to carry, because it is not "nothing happened":** root custody
|
||||
is now recorded in `AGENTS.md` §7 and nowhere public. ⚠️ **Nothing about it may
|
||||
be published without asking him again**, and the question to ask is not *who
|
||||
holds root* — that is answered — but *whether anyone else does*. The original
|
||||
reasoning still holds and is why the page's first sentence is scoped as it is: an
|
||||
account owner's own credential is inherent to every cloud account and is not a
|
||||
third party who has been *granted* access, which is why the measured claim was
|
||||
always scoped to *"every user and every role"* rather than to a bare "nobody else
|
||||
can".
|
||||
|
||||
- *"The function that receives the form can only add a record and cannot read the
|
||||
table back"* — `adr-intake-lambda-role` returns `allowed` for `PutItem` and
|
||||
`implicitDeny` for `GetItem`, `Query`, `Scan`, `BatchGetItem`, `UpdateItem` and
|
||||
`DeleteItem`. Previously this rested on reading the policy document; it is now
|
||||
the simulator's decision.
|
||||
- *"the credential that publishes this website has no access to the table at
|
||||
all"* — `adr-sml-deploy` is `implicitDeny` on all **seven**, so "at all" now
|
||||
covers writes and deletes as well as reads.
|
||||
**Two claims are supported that were not before. One of them still ships; the
|
||||
other was deleted from the page by ruling on 2026-09-02 and is kept here because
|
||||
it remains true and remains §7's.**
|
||||
|
||||
- **SHIPS** — *"The system that receives what you send can only add a record — it
|
||||
cannot read back what is stored"* — `adr-intake-lambda-role` returns `allowed`
|
||||
for `PutItem` and `implicitDeny` for `GetItem`, `Query`, `Scan`,
|
||||
`BatchGetItem`, `UpdateItem` and `DeleteItem`. Previously this rested on
|
||||
reading the policy document; it is now the simulator's decision.
|
||||
- **NO LONGER ON THE PAGE** — *"the credential that publishes this website has no
|
||||
access to the table at all"* — `adr-sml-deploy` is `implicitDeny` on all
|
||||
**seven**, so "at all" covers writes and deletes as well as reads. It went with
|
||||
the mechanics cut, not because anything about it changed.
|
||||
|
||||
**And it corroborates §10 from the IAM surface.** Of the 26 non-service-linked
|
||||
roles, **9 belong to CDK bootstrap** and **14 to four unrelated production
|
||||
systems** in the same account — which is what `/legal/privacy/` now tells a
|
||||
reader in as many words. *(Their role names were listed here until 2026-09-02 and
|
||||
systems** in the same account. *(`/legal/privacy/` tells a reader this in as many words —
|
||||
*"The table sits in an Amazon Web Services account that also runs systems
|
||||
unrelated to this practice"* — in **§Where it is stored**, which is where the
|
||||
sentence now lives: the mechanics cut removed it and it was restored there, as a
|
||||
storage disclosure rather than a method. §10 is unaffected either way; it never
|
||||
depended on the page saying so.)* *(Their role names were listed here until 2026-09-02 and
|
||||
are not any more: this is a committed file, they are another project's IAM
|
||||
surface, and the count carries the whole of the argument. `adversarial-reviewer`,
|
||||
round 2.)*
|
||||
|
||||
+16
-17
@@ -415,23 +415,22 @@ const FIXTURES = {
|
||||
the wording a correction is likely to reach for. Where a fixture is one of
|
||||
those, the comment beside it says so. */
|
||||
mustNotMatch: [
|
||||
/* NEGATIVE FIXTURES FOR `sole-administrator-q62`. The first SEVEN are LIVE
|
||||
PAGE COPY, verbatim from the corrected `/legal/privacy/` —
|
||||
which is the fixture that matters, because Q62's ruling required this
|
||||
pattern to be proven silent on the true sentence as well as loud on the
|
||||
false one. THEY MUST BE RE-SYNCED WHENEVER THAT COPY CHANGES — this set
|
||||
has now gone stale twice, once within the hour of being written and again
|
||||
when Pouya's 2026-09-02 ruling took the human headcount off the page. The
|
||||
rest are near misses on the same subject: the pattern is anchored on five
|
||||
strings that reached `dist/`, not on the ideas in them, so a truthful
|
||||
sentence about administrative access must pass. */
|
||||
"The account's administrators can — me, and the small number of people who administer it with me. The table sits in an Amazon Web Services account that also runs systems unrelated to this practice, and administrative access to that account carries the ability to read the table. That is who can read the stored record; who reads the notification email is a separate question, answered in the last paragraph of this section.",
|
||||
'The access itself is measured rather than assumed: every user and every role in the account was simulated against this table, and every identity that comes back able to read it is reachable only by those administrators.',
|
||||
"The account's root credential — the one path no policy constrains — has no programmatic key, and I hold it.",
|
||||
'Two things in the system are narrower than I am, and they are worth stating because they are the part you cannot check for yourself.',
|
||||
/* The replacement summary, which must not trip the third-surface alternative. */
|
||||
"There are therefore three copies of what you send. The record in the table, which the account's administrators can read.",
|
||||
"The notification, which lands in the practice's mailbox — read by me and by administrative staff — on Google Workspace, so Google holds a copy of whatever you sent me.",
|
||||
/* NEGATIVE FIXTURES FOR `sole-administrator-q62`. The first FIVE are LIVE
|
||||
PAGE COPY, verbatim from the corrected `/legal/privacy/` — which is the
|
||||
fixture that matters, because Q62's ruling required this pattern to be
|
||||
proven silent on the true sentence as well as loud on the false one.
|
||||
RE-SYNC THEM WHENEVER THAT COPY CHANGES. ⚠️ **A SENTENCE THAT LEAVES THE
|
||||
PAGE LEAVES THIS LIST — it is not kept as a near miss.** Struck copy in a
|
||||
list captioned "what this site legitimately publishes" is an invitation to
|
||||
restore it. The rest below ARE near misses on the same subject: the
|
||||
pattern is anchored on five strings that reached `dist/`, not on the ideas
|
||||
in them, so a truthful sentence about administrative access must pass.
|
||||
Rendered as text, without the `<strong>` wrappers — what is proven is that
|
||||
the PATTERN is silent on the words. */
|
||||
'The record in the table: me, and the small number of people who administer the account it sits in with me.',
|
||||
'The system that receives what you send can only add a record — it cannot read back what is stored.',
|
||||
"The notification goes to the practice's mailbox, which is read by me and by administrative staff and is hosted on Google Workspace — so Google holds a copy of whatever you send me.",
|
||||
'The confirmation that went to you sits with whoever runs your email. That copy is in your hands rather than mine.',
|
||||
'No one else is sent it. There is no CRM, no mailing list and no analytics on the submission.',
|
||||
'The table is reachable by the function that writes to it.',
|
||||
'Two accounts hold administrative access to the AWS account, and the function that writes to the table cannot read it.',
|
||||
|
||||
+9
-1
@@ -172,9 +172,17 @@ export const INTAKE_FIELDS: readonly IntakeField[] = [
|
||||
* is the one the inquirer ticks; both ship on `/contact/`, which is deliberate:
|
||||
* `docs/01` requires the page to carry the notice, and `docs/05` requires the
|
||||
* checkbox to carry it too.
|
||||
*
|
||||
* ⚠️ **IT NAMES SML COMPANY LTD — Pouya's ruling, 2026-09-02 — AND THREE
|
||||
* CONSTRAINTS RIDE ON THAT.** **Name only, no terminal period**, and never
|
||||
* beside the licence-status row (`AGENTS.md` §4). **`docs/05` §Consent text is a
|
||||
* byte-identical second copy with no `check:` script over it**, so it moves with
|
||||
* this string. And **`/legal/privacy/` must keep naming the same party** — it
|
||||
* does, under §Why it is collected; a consent naming a company the linked policy
|
||||
* never mentions is an accountability gap, not a matter of voice.
|
||||
*/
|
||||
export const CONSENT_TEXT =
|
||||
'I consent to Pouya Lajevardi storing and using the information in this form ' +
|
||||
'I consent to SML Company Ltd storing and using the information in this form ' +
|
||||
'to respond to my inquiry and to run a conflicts check. I understand that ' +
|
||||
'submitting this form does not create a retainer, does not appoint a neutral, ' +
|
||||
'and does not itself establish a mediator–party relationship.';
|
||||
|
||||
@@ -171,7 +171,9 @@ const COLLECTED = INTAKE_FIELDS.map((field) => field.label);
|
||||
<p>
|
||||
To reply to your inquiry and to run a conflicts check. The basis is
|
||||
your consent, which the form asks for explicitly with an unchecked box
|
||||
you have to tick. The wording you agree to is on the form itself.
|
||||
you have to tick. The wording you agree to is on the form itself, and
|
||||
it names <strong>SML Company Ltd</strong>, the company that holds this
|
||||
practice's systems.
|
||||
</p>
|
||||
<p>
|
||||
It is not used for marketing. It is not sold, rented or shared with
|
||||
@@ -185,6 +187,10 @@ const COLLECTED = INTAKE_FIELDS.map((field) => field.label);
|
||||
the form — a notification to the practice and a confirmation to you —
|
||||
using Amazon Simple Email Service, also in the same Canadian region.
|
||||
</p>
|
||||
<p>
|
||||
The table sits in an Amazon Web Services account that also runs
|
||||
systems unrelated to this practice.
|
||||
</p>
|
||||
{
|
||||
/* ⚠️ TWO PROCESSORS, AND BOTH MUST BE NAMED. `AGENTS.md` §7 records
|
||||
mail hosting as **Google Workspace** and D18 sends the notification to
|
||||
@@ -245,85 +251,52 @@ const COLLECTED = INTAKE_FIELDS.map((field) => field.label);
|
||||
|
||||
<h2>Who can see it</h2>
|
||||
{
|
||||
/* ⚠️ THESE NINE PARAGRAPHS ANSWER "WHO CAN SEE IT" AND THEY CHANGE
|
||||
TOGETHER — by opening phrase, because every defect here has been a
|
||||
partial sweep and a COUNT is what drifts. **This section:** "The
|
||||
account's administrators can", "The access itself is measured", "Two
|
||||
things in the system are narrower", "There are therefore three
|
||||
copies". **§Where it is stored, all four:** "In a DynamoDB table",
|
||||
"Two companies therefore process it", "The confirmation sent to you",
|
||||
"No one else is sent it". **§How long it is kept:** "Emails are a
|
||||
separate matter".
|
||||
**NO HUMAN HEADCOUNT SHIPS** — Pouya, 2026-09-02: the simulation
|
||||
counts identities, not people. Say "the account's administrators".
|
||||
**TWO CLAIMS GO STALE ON THEIR OWN**, both about the present state of
|
||||
systems outside this repo: the AWS enumeration and who reads
|
||||
`info@smlcompany.ca`. Their durable homes are `AGENTS.md` §7's two
|
||||
rows and §12 **R21** claims (i)–(v), which is the trigger for both;
|
||||
`docs/reference/intake-table-access-verification.md` holds the
|
||||
commands. **§9 Q63 is closed — the live gate is Q64.**
|
||||
`check-claims.mjs`'s `sole-administrator-q62` pattern bars the OLD
|
||||
false shape permanently and is blind to both. */
|
||||
}
|
||||
<p>
|
||||
The account's administrators can — me, and the small number of people
|
||||
who administer it with me. The table sits in an Amazon Web Services
|
||||
account that also runs systems unrelated to this practice, and
|
||||
administrative access to that account carries the ability to read the
|
||||
table. That is who can read the stored record; who reads the
|
||||
notification email is a separate question, answered in the last
|
||||
paragraph of this section.
|
||||
</p>
|
||||
<p>
|
||||
The access itself is measured rather than assumed: every user and
|
||||
every role in the account was simulated against this table, and every
|
||||
identity that comes back able to read it is reachable only by those
|
||||
administrators. The account has no single sign-on and no federated
|
||||
login configured, and the table carries no policy of its own granting
|
||||
access to anyone. The account's root credential — the one path no
|
||||
policy constrains — has no programmatic key, and I hold it. Amazon Web
|
||||
Services operates the table, as <em>Where it is stored</em> above says:
|
||||
a company that runs a database is not someone who has been given access
|
||||
to it, and both of those are true at once.
|
||||
</p>
|
||||
{
|
||||
/* TODO(pouya): DOES ANYONE ELSE HOLD THE ROOT PASSWORD OR ITS MFA
|
||||
DEVICE? `AGENTS.md` §9 **Q64**. You attested that you hold it
|
||||
(Q63(c)) and the paragraph above ships your words — *"has no
|
||||
programmatic key, and I hold it"* — which is true whether or not
|
||||
somebody else holds it too. ⚠️ **But it sits one paragraph below "the
|
||||
small number of people who administer it with me", and a reader takes
|
||||
it as SOLE custody.** Nothing measured establishes that: root is not
|
||||
an IAM principal, cannot be simulated, and `get-account-summary`
|
||||
reports only that there is no access key and that MFA is on. If it is
|
||||
sole custody, say so and §12 R21 arms it; if it is not, the possessive
|
||||
comes out. One line either way. `adversarial-reviewer`, round 1. */
|
||||
}
|
||||
<p>
|
||||
Two things in the system are narrower than I am, and they are worth
|
||||
stating because they are the part you cannot check for yourself. The
|
||||
function that receives the form
|
||||
<strong>can only add a record — it cannot read the table back.</strong
|
||||
> And the credential that publishes this website has
|
||||
<strong>no access to the table at all</strong>, for reading or for
|
||||
writing.
|
||||
</p>
|
||||
{
|
||||
/* ⚠️ THREE COPIES, NOT TWO, AND THE THIRD IS THE READER'S OWN: the
|
||||
/* ⚠️ THIS SECTION AND THE SENTENCES BELOW ANSWER THE SAME QUESTION
|
||||
AND CHANGE TOGETHER — by OPENING PHRASE, never by count. **Here:**
|
||||
"The record in the table", "The system that receives", "The
|
||||
notification goes to", "The confirmation that went to you".
|
||||
**§Where it is stored:** "In a DynamoDB table", "The table sits in an
|
||||
Amazon Web Services account", "Two companies therefore process it",
|
||||
"The confirmation sent to you", "No one else is sent it". **§How long
|
||||
it is kept:** "Emails are a separate matter".
|
||||
⚠️ **THIS SECTION STATES WHO, NOT HOW — Pouya's ruling, 2026-09-02.
|
||||
NOT TO BE RESTORED HERE:** the measurement paragraph, the
|
||||
root-credential sentence, the single-sign-on and federated-login
|
||||
enumeration, the resource-policy clause, the "company that runs a
|
||||
database" aside, the deploy-credential sentence and the three-copies
|
||||
summary. All true, all still in `AGENTS.md` §7 and
|
||||
`docs/reference/intake-table-access-verification.md`. **No human
|
||||
headcount** — a simulation counts identities, not people.
|
||||
⚠️ **SENTENCE 1 IS SCOPED TO THE STORED RECORD** (paragraph 3 names
|
||||
administrative staff, who read the mailbox and **cannot** read the
|
||||
table) **AND PREDICATED ON ADMINISTERING THE ACCOUNT** (what §7
|
||||
measures). §4 carries the row and the bar: **never widen it to
|
||||
running, founding, practising or acting.**
|
||||
**TWO CLAIMS GO STALE ON THEIR OWN** — who administers the account,
|
||||
and who reads `info@smlcompany.ca`. §7 holds both; §12 **R21** is the
|
||||
trigger.
|
||||
⚠️ **THERE ARE THREE COPIES AND THE THIRD IS THE READER'S OWN** — the
|
||||
handler puts the whole submission into the confirmation it sends the
|
||||
inquirer, under "What you sent:" (the second `SendEmailCommand` in
|
||||
`backend/intake/handler.mjs`). Do not write "the one other place a
|
||||
copy exists" — an absolute enumeration standing one section from the
|
||||
page's own counter-example is what Q62 was. */
|
||||
inquirer. Never write "the one other place a copy exists". */
|
||||
}
|
||||
<p>
|
||||
There are therefore three copies of what you send. The record in the
|
||||
table, which the account's administrators can read. The notification,
|
||||
which lands in the practice's mailbox — read by me and by
|
||||
administrative staff — on Google Workspace, so Google holds a copy of
|
||||
whatever you sent me. And the confirmation that went to you, which
|
||||
sits with whoever runs your email; that copy is in your hands rather
|
||||
than mine.
|
||||
The record in the table: me, and the small number of people who
|
||||
administer the account it sits in with me.
|
||||
</p>
|
||||
<p>
|
||||
The system that receives what you send
|
||||
<strong
|
||||
>can only add a record — it cannot read back what is stored.</strong
|
||||
>
|
||||
</p>
|
||||
<p>
|
||||
The notification goes to the practice's mailbox, which is read by me
|
||||
and by administrative staff and is hosted on Google Workspace — so
|
||||
Google holds a copy of whatever you send me.
|
||||
</p>
|
||||
<p>
|
||||
The confirmation that went to you sits with whoever runs your email.
|
||||
That copy is in your hands rather than mine.
|
||||
</p>
|
||||
|
||||
<h2>Cookies and analytics</h2>
|
||||
|
||||
Reference in New Issue
Block a user