Pouya/adr-sml
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: cut /legal/privacy/ §Who can see it to four plain statements; name SML Company Ltd on the consent; close Q64 moot

Browse Source 
Two rulings from Pouya, 2026-09-02.

(1) The section stays generic — "it over-explains technical mechanics that
belong in the evidence file, not in front of an inquirer." Deleted: the
measurement paragraph, the root-credential sentence, the SSO/federated-login
enumeration, the resource-policy clause, the "company that runs a database"
aside, the deploy-credential sentence and the three-copies summary. All of it
stays true and stays measured in AGENTS.md §7 and the evidence file, which now
maps each shipped sentence to what it rests on.

(2) The consent string names the corporation: "I consent to SML Company Ltd
storing and using the information in this form…". docs/05 §Consent text moves
with it, proven byte-identical. Two new §4 rows carry the attestations the copy
rests on.

(3) The §Who can see it approval closes via the page read-through, which is now
blocker 2 in docs/06's callout rather than a checklist line.

Q64 closes MOOT — the paragraph it was about was deleted, so it gates nothing.
The underlying gap is unchanged: §7 records root as held by Pouya, not held only
by Pouya, and nothing about root custody may be published without asking again.

Two sentences were added back under review: the shared-account disclosure, to
§Where it is stored (a storage disclosure, never named in the ruling — without
it no page said the intake sits in a shared account), and one naming SML Company
Ltd in the policy, because a consent naming a company the linked policy never
mentions is an accountability gap.

adversarial-reviewer, two rounds, 14 findings, all resolved, none declined;
nine of round 2's ten were defects in round 1's own repairs. claims-auditor
correctly deferred to cutover per D20.

Gates, exit status read: check 0 · build 0 (23 pages) · check:claims 0
(12 patterns, 33 approved strings) · check:intake 0 · og:proof 0 · lint 0 ·
lighthouse 0, worst of 23 99/100/100/100. Tripwire proven both ways — exit 0 on
the revised page, exit 1 with 5 matches on the bd282aa bytes. Regex untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5
This commit is contained in:
Pouya Lajevardi
2026-09-02 12:03:47 -04:00
co-authored by Claude Opus 5
parent 99889a3491
commit 4735989f0b
7 changed files with 602 additions and 259 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pages/legal/privacy.astro
+50 -77
View File
@@ -171,7 +171,9 @@ const COLLECTED = INTAKE_FIELDS.map((field) => field.label);
<p>
To reply to your inquiry and to run a conflicts check. The basis is
your consent, which the form asks for explicitly with an unchecked box
you have to tick. The wording you agree to is on the form itself.
you have to tick. The wording you agree to is on the form itself, and
it names <strong>SML Company Ltd</strong>, the company that holds this
practice's systems.
</p>
<p>
It is not used for marketing. It is not sold, rented or shared with
@@ -185,6 +187,10 @@ const COLLECTED = INTAKE_FIELDS.map((field) => field.label);
the form — a notification to the practice and a confirmation to you —
using Amazon Simple Email Service, also in the same Canadian region.
</p>
<p>
The table sits in an Amazon Web Services account that also runs
systems unrelated to this practice.
</p>
{
/* ⚠️ TWO PROCESSORS, AND BOTH MUST BE NAMED. `AGENTS.md` §7 records
mail hosting as **Google Workspace** and D18 sends the notification to
@@ -245,85 +251,52 @@ const COLLECTED = INTAKE_FIELDS.map((field) => field.label);
<h2>Who can see it</h2>
{
/* ⚠️ THESE NINE PARAGRAPHS ANSWER "WHO CAN SEE IT" AND THEY CHANGE
TOGETHER — by opening phrase, because every defect here has been a
partial sweep and a COUNT is what drifts. **This section:** "The
account's administrators can", "The access itself is measured", "Two
things in the system are narrower", "There are therefore three
copies". **§Where it is stored, all four:** "In a DynamoDB table",
"Two companies therefore process it", "The confirmation sent to you",
"No one else is sent it". **§How long it is kept:** "Emails are a
separate matter".
**NO HUMAN HEADCOUNT SHIPS** — Pouya, 2026-09-02: the simulation
counts identities, not people. Say "the account's administrators".
**TWO CLAIMS GO STALE ON THEIR OWN**, both about the present state of
systems outside this repo: the AWS enumeration and who reads
`info@smlcompany.ca`. Their durable homes are `AGENTS.md` §7's two
rows and §12 **R21** claims (i)–(v), which is the trigger for both;
`docs/reference/intake-table-access-verification.md` holds the
commands. **§9 Q63 is closed — the live gate is Q64.**
`check-claims.mjs`'s `sole-administrator-q62` pattern bars the OLD
false shape permanently and is blind to both. */
}
<p>
The account's administrators can — me, and the small number of people
who administer it with me. The table sits in an Amazon Web Services
account that also runs systems unrelated to this practice, and
administrative access to that account carries the ability to read the
table. That is who can read the stored record; who reads the
notification email is a separate question, answered in the last
paragraph of this section.
</p>
<p>
The access itself is measured rather than assumed: every user and
every role in the account was simulated against this table, and every
identity that comes back able to read it is reachable only by those
administrators. The account has no single sign-on and no federated
login configured, and the table carries no policy of its own granting
access to anyone. The account's root credential — the one path no
policy constrains — has no programmatic key, and I hold it. Amazon Web
Services operates the table, as <em>Where it is stored</em> above says:
a company that runs a database is not someone who has been given access
to it, and both of those are true at once.
</p>
{
/* TODO(pouya): DOES ANYONE ELSE HOLD THE ROOT PASSWORD OR ITS MFA
DEVICE? `AGENTS.md` §9 **Q64**. You attested that you hold it
(Q63(c)) and the paragraph above ships your words — *"has no
programmatic key, and I hold it"* — which is true whether or not
somebody else holds it too. ⚠️ **But it sits one paragraph below "the
small number of people who administer it with me", and a reader takes
it as SOLE custody.** Nothing measured establishes that: root is not
an IAM principal, cannot be simulated, and `get-account-summary`
reports only that there is no access key and that MFA is on. If it is
sole custody, say so and §12 R21 arms it; if it is not, the possessive
comes out. One line either way. `adversarial-reviewer`, round 1. */
}
<p>
Two things in the system are narrower than I am, and they are worth
stating because they are the part you cannot check for yourself. The
function that receives the form
<strong>can only add a record — it cannot read the table back.</strong
> And the credential that publishes this website has
<strong>no access to the table at all</strong>, for reading or for
writing.
</p>
{
/* ⚠️ THREE COPIES, NOT TWO, AND THE THIRD IS THE READER'S OWN: the
/* ⚠️ THIS SECTION AND THE SENTENCES BELOW ANSWER THE SAME QUESTION
AND CHANGE TOGETHER — by OPENING PHRASE, never by count. **Here:**
"The record in the table", "The system that receives", "The
notification goes to", "The confirmation that went to you".
**§Where it is stored:** "In a DynamoDB table", "The table sits in an
Amazon Web Services account", "Two companies therefore process it",
"The confirmation sent to you", "No one else is sent it". **§How long
it is kept:** "Emails are a separate matter".
⚠️ **THIS SECTION STATES WHO, NOT HOW — Pouya's ruling, 2026-09-02.
NOT TO BE RESTORED HERE:** the measurement paragraph, the
root-credential sentence, the single-sign-on and federated-login
enumeration, the resource-policy clause, the "company that runs a
database" aside, the deploy-credential sentence and the three-copies
summary. All true, all still in `AGENTS.md` §7 and
`docs/reference/intake-table-access-verification.md`. **No human
headcount** — a simulation counts identities, not people.
⚠️ **SENTENCE 1 IS SCOPED TO THE STORED RECORD** (paragraph 3 names
administrative staff, who read the mailbox and **cannot** read the
table) **AND PREDICATED ON ADMINISTERING THE ACCOUNT** (what §7
measures). §4 carries the row and the bar: **never widen it to
running, founding, practising or acting.**
**TWO CLAIMS GO STALE ON THEIR OWN** — who administers the account,
and who reads `info@smlcompany.ca`. §7 holds both; §12 **R21** is the
trigger.
⚠️ **THERE ARE THREE COPIES AND THE THIRD IS THE READER'S OWN** — the
handler puts the whole submission into the confirmation it sends the
inquirer, under "What you sent:" (the second `SendEmailCommand` in
`backend/intake/handler.mjs`). Do not write "the one other place a
copy exists" — an absolute enumeration standing one section from the
page's own counter-example is what Q62 was. */
inquirer. Never write "the one other place a copy exists". */
}
<p>
There are therefore three copies of what you send. The record in the
table, which the account's administrators can read. The notification,
which lands in the practice's mailbox — read by me and by
administrative staff — on Google Workspace, so Google holds a copy of
whatever you sent me. And the confirmation that went to you, which
sits with whoever runs your email; that copy is in your hands rather
than mine.
The record in the table: me, and the small number of people who
administer the account it sits in with me.
</p>
<p>
The system that receives what you send
<strong
>can only add a record — it cannot read back what is stored.</strong
>
</p>
<p>
The notification goes to the practice's mailbox, which is read by me
and by administrative staff and is hosted on Google Workspace — so
Google holds a copy of whatever you send me.
</p>
<p>
The confirmation that went to you sits with whoever runs your email.
That copy is in your hands rather than mine.
</p>
<h2>Cookies and analytics</h2>