Pouya/adr-sml
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: cut /legal/privacy/ §Who can see it to four plain statements; name SML Company Ltd on the consent; close Q64 moot

Browse Source 
Two rulings from Pouya, 2026-09-02.

(1) The section stays generic — "it over-explains technical mechanics that
belong in the evidence file, not in front of an inquirer." Deleted: the
measurement paragraph, the root-credential sentence, the SSO/federated-login
enumeration, the resource-policy clause, the "company that runs a database"
aside, the deploy-credential sentence and the three-copies summary. All of it
stays true and stays measured in AGENTS.md §7 and the evidence file, which now
maps each shipped sentence to what it rests on.

(2) The consent string names the corporation: "I consent to SML Company Ltd
storing and using the information in this form…". docs/05 §Consent text moves
with it, proven byte-identical. Two new §4 rows carry the attestations the copy
rests on.

(3) The §Who can see it approval closes via the page read-through, which is now
blocker 2 in docs/06's callout rather than a checklist line.

Q64 closes MOOT — the paragraph it was about was deleted, so it gates nothing.
The underlying gap is unchanged: §7 records root as held by Pouya, not held only
by Pouya, and nothing about root custody may be published without asking again.

Two sentences were added back under review: the shared-account disclosure, to
§Where it is stored (a storage disclosure, never named in the ruling — without
it no page said the intake sits in a shared account), and one naming SML Company
Ltd in the policy, because a consent naming a company the linked policy never
mentions is an accountability gap.

adversarial-reviewer, two rounds, 14 findings, all resolved, none declined;
nine of round 2's ten were defects in round 1's own repairs. claims-auditor
correctly deferred to cutover per D20.

Gates, exit status read: check 0 · build 0 (23 pages) · check:claims 0
(12 patterns, 33 approved strings) · check:intake 0 · og:proof 0 · lint 0 ·
lighthouse 0, worst of 23 99/100/100/100. Tripwire proven both ways — exit 0 on
the revised page, exit 1 with 5 matches on the bd282aa bytes. Regex untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5
This commit is contained in:
Pouya Lajevardi
2026-09-02 12:03:47 -04:00
co-authored by Claude Opus 5
parent 99889a3491
commit 4735989f0b
7 changed files with 602 additions and 259 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/06-deployment.md
+134 -91
View File
@@ -396,18 +396,23 @@ Then invalidate `/*`.
> deployment takes.
> 🛑 **TWO THINGS BLOCK THIS ENTIRE LIST AS AT 2026-09-02: ONE WAITING PERIOD
> AND ONE LINE FROM POUYA.**
> AND ONE READ-THROUGH.**
>
> ⚠️ *(The count has moved twice in one day and the DIRECTION is what to read.
> It said ONE for part of 2026-09-02 and that was a **defect** — the wording
> approval Pouya reserved had been recorded only inside records marked closed,
> the `TODO(pouya)` deleted, Q62 struck, this callout ticked, so nothing would
> have stopped unapproved copy publishing (`adversarial-reviewer`, D20 pass
> round 1). Q63 was then **answered** in three limbs by ruling, which is a gate
> closed by an answer rather than by deletion. Answering it opened **Q64**, one
> paragraph lower on the same page. **A question that closes and a question that
> is deleted look identical in a count and nowhere else, which is why the count
> is never the record.**)*
> ⚠️ *(The count has moved repeatedly in one day and the DIRECTION is the only
> part worth reading — the number of moves is deliberately not stated, because a
> tally of how often a tally changed is the same trap one level up. It said ONE for part of 2026-09-02 and that was a
> **defect** — the wording approval Pouya reserved had been recorded only inside
> records marked closed, the `TODO(pouya)` deleted, Q62 struck, this callout
> ticked, so nothing would have stopped unapproved copy publishing
> (`adversarial-reviewer`, D20 pass round 1). Q63 was then **answered** in three
> limbs by ruling, which is a gate closed by an answer rather than by deletion —
> and answering it **opened Q64**, one paragraph lower on the same page. Q64 then
> left the list a **third** way: **the paragraph it was about was deleted**, so
> the question is moot rather than answered. **Closed, deleted, and moot look
> identical in a count and nowhere else, which is why the count is never the
> record.** The second slot is no longer a question at all — it is the human
> pass, promoted here from the checklist below because that is where the last
> reserved approval went missing.)*
>
> 1. **Q60 — the retention MECHANISM has still not been observed.** TTL is
> `ENABLED` and no record has been watched to disappear, and
@@ -416,15 +421,23 @@ Then invalidate `/*`.
> record is written and it does not call failure before **7 days**, so
> **start it before anything else on this page.** It is the one blocker
> that is a waiting period rather than a task.
> 2. **Q64 — does anyone else hold the AWS root password or its MFA device?**
> `/legal/privacy/` publishes *"has no programmatic key, and I hold it"* — his
> own words from the Q63(c) ruling, **true whether or not someone else holds
> it too**, sitting one paragraph below *"the small number of people who
> administer it with me"*, where a reader takes it as **sole** custody. Root
> cannot be simulated, so nothing establishes that either way. **One line
> settles it:** sole custody → say so, record it in §7, arm §12 R21; not sole
> → the possessive comes out and the sentence keeps its measured half. See the
> unticked item under **Copy and claims** below.
> 2. **Pouya has not yet read every page against `AGENTS.md` §4.** The human
> pass — the other half of D20, and not delegable. **It is also where the
> §Who can see it approval now lands:** Pouya ruled on 2026-09-02 that the
> read-through *is* the approval and that nothing is to be held open waiting
> on a separate wording sign-off. The item under **Copy and claims** below
> carries what to read first and why.
>
> ✅ **CLOSED 2026-09-02 — Q64, MOOT.** It asked whether anyone else holds the
> AWS root password or its MFA device, because the page published *"has no
> programmatic key, and I hold it"* one paragraph below *"the small number of
> people who administer it with me"*, where a reader takes it as **sole**
> custody. **Pouya's second ruling that day deleted the sentence** — the section
> is now four plain statements and says nothing about root — so the question no
> longer gates anything. ⚠️ **The underlying fact is unchanged and unestablished:
> §7 records root as *held by Pouya*, which is not *held only by Pouya*, and
> nothing measured can settle it. Nothing may be published about root custody
> without asking again.**
>
> ✅ **CLOSED 2026-09-02 — Q63, all three limbs, by ruling.** **(a)** The §Who
> can see it wording is **approved with two trims** — the editorial closing
@@ -439,15 +452,54 @@ Then invalidate `/*`.
> humans**. No numeric human headcount ships; the page attributes read access to
> *"the account's administrators — me, and the small number of people who
> administer it with me"*. §12 **R21** is re-scoped to match.
> ⚠️ *(Superseded the same day in its details, not in its rulings: the ruling
> below cut the section to four plain statements, so the sentence quoted above is
> no longer the shipped one and root is not mentioned at all. Each limb of Q63
> still stands — no headcount, the mailbox named, root attested in §7.)*
>
> ✅ **CLOSED 2026-09-02 — THE SECTION IS GENERIC, by a second ruling the same
> day.** *"It over-explains technical mechanics that belong in the evidence file,
> not in front of an inquirer."* §Who can see it is now **four short statements**
> — who can read it, that the receiving system can only add a record, where the
> notification goes and who reads it, and that the confirmation sits with the
> reader's own provider. **Deleted from §Who can see it:** the measurement
> paragraph, the root-credential sentence, the single-sign-on and federated-
> login enumeration, the resource-policy clause, the *"company that runs a
> database"* aside, the deploy-credential sentence and the three-copies
> summary. ⚠️ **THE SHARED-ACCOUNT CLAUSE WAS CUT WITH THEM AND THEN RESTORED
> — to §Where it is stored, where it belongs.** It is a storage disclosure
> rather than mechanics, the ruling did not name it, and without it no page
> told a reader their intake sits in an account that also runs unrelated
> systems (`adversarial-reviewer`, round 1). **These lists must stay identical
> — there were four of them and they named four different sets.** **None of
> that verified
> material was lost** — all of it stays in `AGENTS.md` §7 and
> `docs/reference/intake-table-access-verification.md`, and the section comment in
> `src/pages/legal/privacy.astro` bars restoring it to the page. **The risk moved
> in the right direction:** every deleted sentence was a claim about a system
> outside this repository that nothing reports on, which is what §12 **R21**
> exists for — R21 is re-scoped from five live claims to two.
>
> ✅ **CLOSED 2026-09-02 — THE CONSENT STRING NAMES THE CORPORATION.** *"I
> consent to **SML Company Ltd** storing and using the information in this
> form…"*, per ruling, replacing the natural person. It is the one sentence a
> submitter actually agrees to and it is the PIPEDA basis, and the policy it
> links to describes a mailbox read by administrative staff — a corporation is
> the party that matches, and `/legal/privacy/` now names it in terms under §Why
> it is collected. **The NAME ONLY:**
> §4 verifies the federal incorporation, records it as *not published*, and
> cautions that it must never be read beside the licence-status row. `docs/05`
> §Consent text carries the string verbatim and moved with it.
>
> ✅ **CLOSED 2026-09-02 — Q62.** `/legal/privacy/` no longer states anything
> false about who can read the intake table. Pouya's ruling was **state the
> truth**, not remove the second administrator's access: the page attributes read
> access to the account's administrators, names their role, and adds the two
> stronger facts the false sentence had been crowding out — the writing function
> cannot read the table, and the deploy credential has no access to it at all.
> *(It said "two people can read it" until the Q63 ruling later the same day
> replaced the count; see the Q63 block above.)* The
> access to the account's administrators and names their role. *(It said "two
> people can read it" until the Q63 ruling later the same day replaced the count,
> and the ruling after that cut the section to four plain statements — of the two
> stronger facts this entry originally credited it with, the writing function's
> add-only access still ships and the deploy credential's lack of access does
> not. See the two blocks above.)* The
> `sole-administrator-q62` tripwire in `check-claims.mjs` **stays permanently**
> by the same ruling, extended from two alternatives to **five**: the clause the
> first form could not see two sections up the same page, the summary that would
@@ -554,52 +606,35 @@ the decision is re-readable rather than re-litigated.
have flagged correct copy and demanded the struck form. It read §4 instead.
That is the fifth stale claim found in that file and it is not the agent's
to fix
- [x] ✅ **Q63(a) RULED 2026-09-02 — the wording is approved WITH TWO TRIMS.**
The editorial closing sentence (*"I would rather tell you that than give
you the tidier answer"*) is struck, and the mailbox clause is rewritten per
(b). Q62's ruling settled what the section must **say**; he reserved the
**wording**, and that reservation is discharged by the ruling. **This tick
records the RULING, not the current text** — see the next item.
- [ ] 🛑 **THE §Who can see it TEXT AS IT NOW STANDS HAS NOT BEEN READ BY POUYA,
AND IT IS NOT THE TEXT HE APPROVED.** The same ruling that approved the
wording also took the human headcount off the page, and the two review
rounds that followed rewrote both paragraph openings, the root sentence and
the mailbox clause. **The revised section is quoted verbatim in
`docs/reference/intake-table-access-verification.md`** for exactly this
reading. ⚠️ **This item is split from the one above because a single ticked
box over changed copy is the defect the item above was created to stop** —
a person working this list reads the tick, not the eleven lines under it
(`adversarial-reviewer`, round 2). It is narrower than the general
read-through below: this one is the wording approval Pouya reserved in
terms, over the sentences that actually ship.
⚠️ **THIS ITEM EXISTS BECAUSE THE GATE HAD NO MECHANISM.** On 2026-09-02
the `TODO(pouya)` was deleted from the source, Q62 was struck in §9 and the
blocker in the callout above was ticked — all correctly, and the net effect
was that the only surviving record of an **open** approval requirement was
prose inside three records marked ✅ CLOSED. When Q60's TTL test passes,
nothing mechanical or visual would have stopped copy Pouya has not read.
`adversarial-reviewer`, D20 pass round 1. ⚠️ **THAT SENTENCE READ "the
`TODO(pouya)` is reinstated beside the copy and §9 Q63 is open" AFTER BOTH
HAD BEEN CLOSED IN THE SAME CHANGE SET** — a ticked item describing a live
control that no longer existed, which is Q22's shape on the item written to
stop Q22's shape (`adversarial-reviewer`, round 1). **What actually carries
the text as it now stands:** the read-through item below, and §9 **Q64**
with its own `TODO(pouya)` and its own unticked item — because answering
Q63 opened Q64 rather than clearing the section
- [ ] 🛑 **DOES ANYONE ELSE HOLD THE AWS ROOT PASSWORD OR ITS MFA DEVICE —
§9 **Q64**.** `/legal/privacy/` publishes *"Its root credential — the one
path no policy constrains — has no programmatic key, and I hold it"*.
Those are Pouya's own words from the Q63(c) ruling and they are **true
whether or not a second person holds it**; the defect is what a reader
takes from them, one paragraph below *"the small number of people who
administer it with me"*. Root is not an IAM principal and cannot be
simulated, so no measurement settles it — `get-account-summary` gives only
`AccountAccessKeysPresent: 0` and `AccountMFAEnabled: 1`. **Sole custody →
say so on the page, record it in §7, arm §12 R21. Not sole → strike the
possessive and keep the measured half.** `src/pages/legal/privacy.astro`
carries the `TODO(pouya)`. **This is Q63's lesson pointing the other way**:
Q63 struck a sentence for reading identities as people; this one invites a
reader to read a possessive as an exclusion
- [x] ✅ **THE §Who can see it WORDING APPROVAL IS DISCHARGED — Pouya's ruling,
2026-09-02: *"the read-through is the approval."*** Q62 settled what the
section must **say** and he reserved the **wording**; he then ruled twice on
it the same day — Q63(a) approving with two trims, and the second ruling
cutting the section to four plain statements — and directed in terms that
nothing be held open waiting on a separate sign-off. ⚠️ **THIS TICK IS NOT
"THE TEXT HAS BEEN READ".** It records that the reserved approval has
**moved**, to the read-through blocker in the callout above and the item
below. Two ticked boxes stood here for one round — one for the ruling, one
for the text — because a single tick over changed copy is how an approval
requirement went missing the first time (`adversarial-reviewer`, round 2).
They collapse into this one only because the ruling collapsed them, and
the gate did not disappear: **it is blocker 2 in the callout above**, which
is the most-read place on this page rather than the least.
- [x] ✅ **CLOSED 2026-09-02 — Q64 IS MOOT: THE PARAGRAPH WAS DELETED.** It asked
whether anyone else holds the AWS root password or its MFA device, because
`/legal/privacy/` published *"has no programmatic key, and I hold it"* one
paragraph below *"the small number of people who administer it with me"* —
where a reader takes it as **sole** custody, which nothing establishes.
Pouya's second ruling that day struck the sentence along with the rest of
the mechanics, so no page says anything about root and the question gates
nothing. The `TODO(pouya)` is gone from
`src/pages/legal/privacy.astro` with the paragraph that carried it.
⚠️ **THE FACT IS STILL UNESTABLISHED AND THAT DID NOT CHANGE.** §7 records
root as *held by Pouya*, which is not *held only by Pouya*; root is not an
IAM principal and cannot be simulated. **Nothing about root custody may be
published without asking him again** — the section comment in the page
source carries that bar, because "we deleted it" and "we checked it" are
the same green tick from three weeks away.
- [x] ✅ **Q63(b) ANSWERED 2026-09-02 — `info@smlcompany.ca` is a DELEGATED
MAILBOX: Pouya and administrative staff read it.** The page said *"anyone
who can reach that mailbox"*, which was true either way and answered the
@@ -618,12 +653,17 @@ the decision is re-readable rather than re-litigated.
- [ ] **Pouya has read every page against `AGENTS.md` §4.** The human pass. It is
the other half of D20 and it is not delegable — his reading is what the
per-step audit was traded for.
⚠️ **START WITH `/legal/privacy/` §Who can see it.** Every sentence in it
changed on 2026-09-02, twice — once by Q62's ruling and again by Q63's —
and it is the only section on the site whose subject lives entirely outside
this repository. It is also where the approval he reserved lands: Q63(a)
approved the wording, and the wording then changed under the same ruling
when the headcount came out.
⚠️ **START WITH `/legal/privacy/` §Who can see it. IT IS BLOCKER 2 IN THE
CALLOUT ABOVE, AND THIS READ *IS* THE APPROVAL** — Pouya ruled on
2026-09-02 that nothing waits on a separate wording sign-off. Every
sentence in it changed three times that day — Q62's ruling, Q63's, then the
ruling that cut it to **four plain statements** — and it is the only
section on the site whose subject lives entirely outside this repository.
**It is now four sentences and should take a minute**; that is the point of
the cut. The verified material behind them is in
`docs/reference/intake-table-access-verification.md` and `AGENTS.md` §7 if
he wants to check any of it, and **the page deliberately no longer cites
it**.
**Then read the two `/contact/` sentences against it, which is a judgement
rather than a defect** — `/contact/received/` says *"email me directly at
`info@smlcompany.ca` — that reaches me whether or not the receipt did"* and
@@ -634,20 +674,23 @@ the decision is re-readable rather than re-litigated.
the neutral may take more from the word than is true. A sweep of all 23
built pages found these two as the only other surfaces touching the point.
Raised as **consider**, not blocking, by `adversarial-reviewer` round 1.
⚠️ **AND A THIRD SURFACE THAT SWEEP COULD NOT REACH — the CONSENT string,
`src/data/intake.ts`, rendered on `/contact/`:** *"I consent to **Pouya
Lajevardi** storing and using the information in this form…"*. It names a
natural person as the party storing and using the data, while the policy it
links to now describes the practice's mailbox, administrative staff and a
shared AWS account. **Nothing here is false** — he is the accountable
individual and staff act for him — but it is the one sentence a submitter
actually agrees to, and it is the PIPEDA basis. **The sweep that missed it
was anchored on mailbox vocabulary** (*"email me directly"*, *"reaches
me"*), which is R8's sharpest edge: the right command, the wrong anchor.
**Decide it here rather than leaving it implicit** — either widen the
consent, or record that it names the responsible individual deliberately.
Either way the consent string joins the surfaces the mailbox question
governs, so the next answer reaches it. `adversarial-reviewer`, round 2.
✅ **THE THIRD SURFACE IS DECIDED — the CONSENT string now names the
corporation.** *"I consent to **SML Company Ltd** storing and using the
information in this form…"*, Pouya's ruling 2026-09-02, replacing the
natural person. It is the one sentence a submitter actually agrees to and
it is the PIPEDA basis, and the policy it links to describes a mailbox read
by administrative staff — a corporation is the party that matches, and
`/legal/privacy/` now names it in terms under §Why it is collected. **The sweep that had missed it was anchored on
mailbox vocabulary** (*"email me directly"*, *"reaches me"*), which is R8's
sharpest edge: the right command, the wrong anchor.
⚠️ **THE PAGE AROUND IT STILL SAYS "me" AND "I", AND THAT IS DELIBERATE, NOT
AN OVERSIGHT — read the two together and say if it reads wrong.** The
ruling changed the consent sentence and nothing else; `/legal/privacy/` is
written in the first person throughout (*"whatever you send me"*, *"in your
hands rather than mine"*), and `/contact/` is too. Nothing is false either
way — he is the accountable individual, the corporation holds the systems —
but the checkbox and the prose beside it now name different parties, and
**that is a judgement about voice which is his and not a reviewer's.**
- [x] ✅ **MEMBERSHIPS RE-CONFIRMED 2026-09-02 — Pouya: ADRIC, ADRIO, the three
OBA sections and the CTF are all current.** §4 and `src/data/site.ts` are
re-stamped `[verified 2026-09-02 — Pouya]`. ⚠️ **THERE ARE TWO ARRAYS AND