Pouya/adr-sml
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: rule Q63 in three limbs; take the human headcount off /legal/privacy/; close R10; ratify /med-arb/

Browse Source 
Pouya's rulings, 2026-09-02.

Q63(a) — wording approved with two trims: the editorial closing sentence is
struck, and the mailbox clause is rewritten per (b).

Q63(b) — info@smlcompany.ca is a delegated mailbox read by Pouya and by
administrative staff. The page said "anyone who can reach that mailbox"; it now
says who. The answer reached four sentences, not the one the ruling named, in
three sections: "my mailbox" had been written as a personal one throughout.

Q63(c) — the account root credential is held by Pouya, has no programmatic key
and carries MFA. The page now states the first two.

And the answer to (c) took the human headcount off the page. His attestation:
"two people is an exaggeration... a handful is accurate — the simulation counts
identities, not humans, and the two are not the same claim." The enumeration was
exhaustive and the inference off it was not: two IAM identities is a LOWER BOUND
on people and was published as an exact count. The page now attributes read
access to "the account's administrators — me, and the small number of people who
administer it with me", and the false inference is corrected at its source in
docs/reference/intake-table-access-verification.md as well as on the page.

R10 — CLOSED on a fresh one-line confirmation, not on the 2026-08-28 stamp.
ADRIC, ADRIO, the three OBA sections and the CTF all current. Re-stamped on all
four stamp-bearing sites; the row stays live, because its trigger is an event.

/med-arb/ — ratified as shipped, no credential line restored. His note for the
record: med-arb is a service he provides, not a designation.

The tripwire is unchanged and proven both ways: exit 0 on the revised page,
exit 1 with 5 matches on the pre-correction bytes rebuilt from bd282aa.

A sentence added to back the correction had no command behind it. "The table
carries no policy of its own granting access to anyone" was published with
nothing in the repo establishing it — a DynamoDB resource policy is invisible to
describe-table, and every simulation on file asks what a principal may do.
Measured rather than deleted: get-resource-policy returns PolicyNotFoundException,
and describe-organization returns AWSOrganizationsNotInUseException, which is
what makes the Identity Center zero conclusive rather than merely local. Both
recorded as commands 7 and 8; R21 gains claim (v) and two falsifiers.

Q64 OPENED, with a TODO(pouya) and an unticked cutover item: "I hold it" is true
whether or not a second person holds it, and reads as sole custody one paragraph
below "the small number of people who administer it with me". The request to
strike the possessive now is declined with a reason — he dictated the clause —
and the page cannot ship while the TODO stands.

Two review rounds, 22 findings, 21 resolved, 1 declined. Nine of round 2's twelve
were defects in round 1's own repairs. Stopped at two per D19.

Gates, exit status read: check 0 · build 0 (23 pages) · check:claims 0 ·
og:proof 0 · check:intake 0 · lint 0 · router.test 0 (30/30) · lighthouse 0,
worst of 23 99/100/100/100, /legal/privacy/ 100/100/100.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5
This commit is contained in:
Pouya Lajevardi
2026-09-02 11:00:15 -04:00
co-authored by Claude Opus 5
parent 6aaf089b05
commit 99889a3491
9 changed files with 641 additions and 185 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+229 -6
View File
File diff suppressed because one or more lines are too long
docs/05-backend-spec.md
+1 -1
View File
@@ -446,7 +446,7 @@ Plausible or Fathom, cookieless, no consent banner.
- [ ] **TTL set and verified by test record.** ⚠️ **THIS ONE BACKS A PUBLISHED PROMISE.** `/legal/privacy/` states that records are deleted automatically after 24 months, and it asserts the **mechanism**, not only the period. The handler writes the `ttl` attribute — epoch seconds, 24 months, confirmed against this spec `[verified 2026-08-31]` — and **writing the attribute is not the mechanism**: TTL must also be enabled on the table, which is a table setting the code cannot see. **`AGENTS.md` §7 holds that status and its stamp; this line does not restate it** — it restated it once, went stale within the day, and had to be pulled back (§12 R19). **The test record is what closes this item, not the status:** `ENABLED` proves the setting, a record written with a near-future `ttl` and observed to vanish proves the behaviour. Tracked as §9 Q60
- [x] **PITR enabled** — `ENABLED`, 35-day window `[verified 2026-09-01 — describe-continuous-backups]`
- [ ] KMS customer-managed key. **Not on the table: encryption at rest is with the AWS-owned key** `[verified 2026-09-01 — describe-table returns no SSEDescription]`. **Not claimed on `/legal/privacy/`** — the page says "encrypted at rest", which is unconditionally true of every DynamoDB table and does not mention a customer-managed key, so nothing published depends on it. An improvement, not a blocker
- [x] ✅ **Table access matches what `/legal/privacy/` says about it — 2026-09-02.** **The access is unchanged; the page now states it.** Pouya ruled *state the truth* rather than *remove the access* (§9 Q62), so the page publishes two administrators of a shared account, and adds the two stronger facts the false sentence had crowded out: the handler role holds `PutItem` **only**, and `adr-sml-deploy` is `implicitDeny` on all seven read **and** write actions. Evidence and commands: `docs/reference/intake-table-access-verification.md`, whose enumeration was **extended on 2026-09-02** — the original screened roles by `list-attached-role-policies` alone, missing that 23 of 26 non-service-linked roles carry inline policies and that the two CDK `lookup` roles can read the table. Four roles can, not two; all four terminate at the same two people. ⚠️ **THIS LINE SAID "IT DOES NOT" FOR A DAY AFTER THE PAGE WAS CORRECTED, AND IT IS A DEFINITION-OF-DONE LIST SOMEONE FOLLOWS AT CUTOVER** — the Q62 sweep was run over `src/` only, so it could not reach a spec. `adversarial-reviewer`, round 1. The sweep across `docs/` is in the Change Log entry
- [x] ✅ **Table access matches what `/legal/privacy/` says about it — 2026-09-02.** **The access is unchanged; the page now states it.** Pouya ruled *state the truth* rather than *remove the access* (§9 Q62), so the page attributes read access to **the account's administrators of a shared account, with no human headcount** — the count came off later the same day under §9 Q63, because a simulation counts identities and the page was reading them as people — and adds the two stronger facts the false sentence had crowded out: the handler role holds `PutItem` **only**, and `adr-sml-deploy` is `implicitDeny` on all seven read **and** write actions. Evidence and commands: `docs/reference/intake-table-access-verification.md`, whose enumeration was **extended on 2026-09-02** — the original screened roles by `list-attached-role-policies` alone, missing that 23 of 26 non-service-linked roles carry inline policies and that the two CDK `lookup` roles can read the table. Four roles can, not two; every one of them is reachable only by those administrators. ⚠️ **Do not restate that as a count of PEOPLE** — this line said *"all four terminate at the same two people"* until 2026-09-02, which is the inference §9 Q63 struck. ⚠️ **THIS LINE SAID "IT DOES NOT" FOR A DAY AFTER THE PAGE WAS CORRECTED, AND IT IS A DEFINITION-OF-DONE LIST SOMEONE FOLLOWS AT CUTOVER** — the Q62 sweep was run over `src/` only, so it could not reach a spec. `adversarial-reviewer`, round 1. The sweep across `docs/` is in the Change Log entry
- [ ] Both emails send; SPF/DKIM/DMARC aligned; inbox-tested, not spam-tested
- [ ] **CloudWatch alarms on Lambda `Errors` and API Gateway `5xx`** — replacing the DLQ item, which is struck: a DLQ on a **synchronously** invoked function never receives anything, so the alarm on its depth would have been permanently green. See §Notification. The handler writes to DynamoDB **before** sending mail, so the protection this item was pointing at is in the code rather than in a queue
- [x] **Form usable by keyboard only.** Errors are announced by the browser's own validation, which with no script is the only thing that can announce them inline — `role="alert"` needs a live region and something to write into it
docs/06-deployment.md
+165 -49
View File
@@ -395,48 +395,74 @@ Then invalidate `/*`.
> reversing them puts 22 of 23 pages behind a 403 for as long as a CloudFront
> deployment takes.
> 🛑 **TWO THINGS BLOCK THIS ENTIRE LIST AS AT 2026-09-02, AND ONE OF THEM IS A
> WAITING PERIOD RATHER THAN A TASK.**
> 🛑 **TWO THINGS BLOCK THIS ENTIRE LIST AS AT 2026-09-02: ONE WAITING PERIOD
> AND ONE LINE FROM POUYA.**
>
> *(This said ONE for part of 2026-09-02, and that was a defect: the wording
> approval Pouya reserved had been recorded only inside records marked closed —
> the `TODO(pouya)` deleted, Q62 struck, this callout ticked — so when Q60 passed,
> nothing would have stopped unapproved copy publishing. `adversarial-reviewer`,
> D20 pass round 1.)*
> ⚠️ *(The count has moved twice in one day and the DIRECTION is what to read.
> It said ONE for part of 2026-09-02 and that was a **defect** — the wording
> approval Pouya reserved had been recorded only inside records marked closed,
> the `TODO(pouya)` deleted, Q62 struck, this callout ticked, so nothing would
> have stopped unapproved copy publishing (`adversarial-reviewer`, D20 pass
> round 1). Q63 was then **answered** in three limbs by ruling, which is a gate
> closed by an answer rather than by deletion. Answering it opened **Q64**, one
> paragraph lower on the same page. **A question that closes and a question that
> is deleted look identical in a count and nowhere else, which is why the count
> is never the record.**)*
>
> 1. **Q60 — the retention MECHANISM has still not been observed.** TTL is
> `ENABLED` and no record has been watched to disappear, and
> `/legal/privacy/` asserts the mechanism, not merely the period. `docs/09`
> Part 10 is the test; its earliest useful reading is **48 hours** after the
> record is written and it does not call failure before **7 days**, so
> **start it before anything else on this page.** It is the one blocker that
> is a waiting period rather than a task.
> 2. **Q63 — `/legal/privacy/` needs two answers from Pouya**, both in the same
> read-through: **(a)** approval of the §Who can see it wording, which he
> reserved when he ruled Q62 (*"Pouya gives final approval on wording during
> his page read-through"*), and **(b)** who else can read
> `info@smlcompany.ca`, which this repository does not establish. (b) is
> written so nothing false publishes either way; (a) is a straight gate. See
> the unticked item under **Copy and claims** below.
> **start it before anything else on this page.** It is the one blocker
> that is a waiting period rather than a task.
> 2. **Q64 — does anyone else hold the AWS root password or its MFA device?**
> `/legal/privacy/` publishes *"has no programmatic key, and I hold it"* — his
> own words from the Q63(c) ruling, **true whether or not someone else holds
> it too**, sitting one paragraph below *"the small number of people who
> administer it with me"*, where a reader takes it as **sole** custody. Root
> cannot be simulated, so nothing establishes that either way. **One line
> settles it:** sole custody → say so, record it in §7, arm §12 R21; not sole
> → the possessive comes out and the sentence keeps its measured half. See the
> unticked item under **Copy and claims** below.
>
> ✅ **CLOSED 2026-09-02 — Q63, all three limbs, by ruling.** **(a)** The §Who
> can see it wording is **approved with two trims** — the editorial closing
> sentence struck, and the mailbox clause rewritten per (b). **(b)**
> `info@smlcompany.ca` is a **delegated mailbox read by Pouya and by
> administrative staff**, and the page now says so instead of *"anyone who can
> reach that mailbox"*. **(c)** The account **root credential is held by Pouya**;
> it has no programmatic key and MFA is on, and the page now states the first two
> of those. ⚠️ **AND THE ANSWER CHANGED THE HEADLINE SENTENCE:** Pouya's
> attestation is that *"two people is an exaggeration… a handful is accurate"*,
> because **the simulation counts identities and the page was reading them as
> humans**. No numeric human headcount ships; the page attributes read access to
> *"the account's administrators — me, and the small number of people who
> administer it with me"*. §12 **R21** is re-scoped to match.
>
> ✅ **CLOSED 2026-09-02 — Q62.** `/legal/privacy/` no longer states anything
> false about who can read the intake table. Pouya's ruling was **state the
> truth**, not remove the second administrator's access: the page now says two
> people can read it, names their role, and adds the two stronger facts the
> false sentence had been crowding out — the writing function cannot read the
> table, and the deploy credential has no access to it at all. The
> truth**, not remove the second administrator's access: the page attributes read
> access to the account's administrators, names their role, and adds the two
> stronger facts the false sentence had been crowding out — the writing function
> cannot read the table, and the deploy credential has no access to it at all.
> *(It said "two people can read it" until the Q63 ruling later the same day
> replaced the count; see the Q63 block above.)* The
> `sole-administrator-q62` tripwire in `check-claims.mjs` **stays permanently**
> by the same ruling, extended from two alternatives to **five**: the clause the
> first form could not see two sections up the same page, the summary that would
> have re-asserted the struck number four lines below the corrected paragraph,
> and the sentence that carried the false count. Proven both ways against the
> pre-correction page rebuilt from `bd282aa` — **exit 1 with 5 matches**, exit 0
> on the corrected page.
> **Wording is subject to Pouya's read-through — §9 Q63(a), and it has its own
> unticked item below.**
> on the corrected page, and **re-proven both ways after the Q63 rewrite**, same
> 5 matches at the same lines.
>
> ✅ **CLOSED 2026-09-02 — the `/med-arb/` gloss.** Struck, with no replacement
> and no competence claim, per ruling. The ADRIC-sourced material carries the
> and no competence claim, per ruling; **ratified as shipped** on 2026-09-02 with
> no credential line restored. **Pouya's note, recorded because it is the reason
> and not a detail: med-arb is a service he provides, not a designation.** That is
> what makes the struck gloss unrecoverable rather than merely unsourced — there
> is no designation to cite for it. The ADRIC-sourced material carries the
> section.
**Cutover prep — deferred maintenance, done BEFORE the checklist below**
@@ -528,31 +554,112 @@ the decision is re-readable rather than re-litigated.
have flagged correct copy and demanded the struck form. It read §4 instead.
That is the fifth stale claim found in that file and it is not the agent's
to fix
- [ ] 🛑 **POUYA HAS APPROVED THE `/legal/privacy/` §Who can see it WORDING —
§9 **Q63**(a).** Separate from the item below and narrower: Q62's ruling
settled what that section must **say**; he reserved the **wording**. The
draft is in `dist/` and quoted in
`docs/reference/intake-table-access-verification.md`.
- [x] ✅ **Q63(a) RULED 2026-09-02 — the wording is approved WITH TWO TRIMS.**
The editorial closing sentence (*"I would rather tell you that than give
you the tidier answer"*) is struck, and the mailbox clause is rewritten per
(b). Q62's ruling settled what the section must **say**; he reserved the
**wording**, and that reservation is discharged by the ruling. **This tick
records the RULING, not the current text** — see the next item.
- [ ] 🛑 **THE §Who can see it TEXT AS IT NOW STANDS HAS NOT BEEN READ BY POUYA,
AND IT IS NOT THE TEXT HE APPROVED.** The same ruling that approved the
wording also took the human headcount off the page, and the two review
rounds that followed rewrote both paragraph openings, the root sentence and
the mailbox clause. **The revised section is quoted verbatim in
`docs/reference/intake-table-access-verification.md`** for exactly this
reading. ⚠️ **This item is split from the one above because a single ticked
box over changed copy is the defect the item above was created to stop** —
a person working this list reads the tick, not the eleven lines under it
(`adversarial-reviewer`, round 2). It is narrower than the general
read-through below: this one is the wording approval Pouya reserved in
terms, over the sentences that actually ship.
⚠️ **THIS ITEM EXISTS BECAUSE THE GATE HAD NO MECHANISM.** On 2026-09-02
the `TODO(pouya)` was deleted from the source, Q62 was struck in §9 and the
blocker in the callout above was ticked — all correctly, and the net effect
was that the only surviving record of an **open** approval requirement was
prose inside three records marked ✅ CLOSED. When Q60's TTL test passes,
nothing mechanical or visual would have stopped copy Pouya has not read.
`adversarial-reviewer`, D20 pass round 1. The `TODO(pouya)` is reinstated
beside the copy and §9 Q63 is open; this is the third surface, and it is
the one a person following this list at cutover actually reads
- [ ] **Q63(b) answered, or accepted as unanswerable** — who else can read
`info@smlcompany.ca`. **Not a gate on truth**: the copy asserts no access
list, so nothing false publishes either way. It is a gate on **standards** —
the page answers the table half with a measured number and the mail half
without one, and a reader is entitled to the specific on both. If he
answers, the fact goes in §7 and §12 **R21**'s trigger covers it
`adversarial-reviewer`, D20 pass round 1. ⚠️ **THAT SENTENCE READ "the
`TODO(pouya)` is reinstated beside the copy and §9 Q63 is open" AFTER BOTH
HAD BEEN CLOSED IN THE SAME CHANGE SET** — a ticked item describing a live
control that no longer existed, which is Q22's shape on the item written to
stop Q22's shape (`adversarial-reviewer`, round 1). **What actually carries
the text as it now stands:** the read-through item below, and §9 **Q64**
with its own `TODO(pouya)` and its own unticked item — because answering
Q63 opened Q64 rather than clearing the section
- [ ] 🛑 **DOES ANYONE ELSE HOLD THE AWS ROOT PASSWORD OR ITS MFA DEVICE —
§9 **Q64**.** `/legal/privacy/` publishes *"Its root credential — the one
path no policy constrains — has no programmatic key, and I hold it"*.
Those are Pouya's own words from the Q63(c) ruling and they are **true
whether or not a second person holds it**; the defect is what a reader
takes from them, one paragraph below *"the small number of people who
administer it with me"*. Root is not an IAM principal and cannot be
simulated, so no measurement settles it — `get-account-summary` gives only
`AccountAccessKeysPresent: 0` and `AccountMFAEnabled: 1`. **Sole custody →
say so on the page, record it in §7, arm §12 R21. Not sole → strike the
possessive and keep the measured half.** `src/pages/legal/privacy.astro`
carries the `TODO(pouya)`. **This is Q63's lesson pointing the other way**:
Q63 struck a sentence for reading identities as people; this one invites a
reader to read a possessive as an exclusion
- [x] ✅ **Q63(b) ANSWERED 2026-09-02 — `info@smlcompany.ca` is a DELEGATED
MAILBOX: Pouya and administrative staff read it.** The page said *"anyone
who can reach that mailbox"*, which was true either way and answered the
mail half of the question on a lower standard than the table half. It now
states who reads it. The fact is in `AGENTS.md` §7 and **§12 R21's trigger
covers it** — like the AWS enumeration, nothing reports when a delegation
changes. ⚠️ **The answer reached FOUR sentences, not the one the question
named** — §Where it is stored twice, §How long it is kept once, §Who can
see it once — because *"my mailbox"* had been written as a personal one
throughout. That is the fifth partial sweep on this page's who-can-see-it
set; the section comment in `src/pages/legal/privacy.astro` enumerates
them **by opening phrase rather than by count** — deliberately, because the
count has been wrong twice, and this line carried "eight" for a round after
the comment itself had been corrected to nine (`adversarial-reviewer`,
round 2). Read the list, not a number
- [ ] **Pouya has read every page against `AGENTS.md` §4.** The human pass. It is
the other half of D20 and it is not delegable — his reading is what the
per-step audit was traded for.
- [ ] **Memberships RE-CONFIRMED AGAIN, on the day of cutover** — `AGENTS.md`
§12 **R10**, which is now an **event trigger and cutover is one of its two
⚠️ **START WITH `/legal/privacy/` §Who can see it.** Every sentence in it
changed on 2026-09-02, twice — once by Q62's ruling and again by Q63's —
and it is the only section on the site whose subject lives entirely outside
this repository. It is also where the approval he reserved lands: Q63(a)
approved the wording, and the wording then changed under the same ruling
when the headcount came out.
**Then read the two `/contact/` sentences against it, which is a judgement
rather than a defect** — `/contact/received/` says *"email me directly at
`info@smlcompany.ca` — that reaches me whether or not the receipt did"* and
`/contact/` says *"Send the form below, or email me directly"*. **Neither is
false and neither asserts exclusivity**; the mail does reach him. But
`/legal/privacy/` now discloses that administrative staff read that mailbox,
and a party who has just been told to send dispute detail *"directly"* to
the neutral may take more from the word than is true. A sweep of all 23
built pages found these two as the only other surfaces touching the point.
Raised as **consider**, not blocking, by `adversarial-reviewer` round 1.
⚠️ **AND A THIRD SURFACE THAT SWEEP COULD NOT REACH — the CONSENT string,
`src/data/intake.ts`, rendered on `/contact/`:** *"I consent to **Pouya
Lajevardi** storing and using the information in this form…"*. It names a
natural person as the party storing and using the data, while the policy it
links to now describes the practice's mailbox, administrative staff and a
shared AWS account. **Nothing here is false** — he is the accountable
individual and staff act for him — but it is the one sentence a submitter
actually agrees to, and it is the PIPEDA basis. **The sweep that missed it
was anchored on mailbox vocabulary** (*"email me directly"*, *"reaches
me"*), which is R8's sharpest edge: the right command, the wrong anchor.
**Decide it here rather than leaving it implicit** — either widen the
consent, or record that it names the responsible individual deliberately.
Either way the consent string joins the surfaces the mailbox question
governs, so the next answer reaches it. `adversarial-reviewer`, round 2.
- [x] ✅ **MEMBERSHIPS RE-CONFIRMED 2026-09-02 — Pouya: ADRIC, ADRIO, the three
OBA sections and the CTF are all current.** §4 and `src/data/site.ts` are
re-stamped `[verified 2026-09-02 — Pouya]`. ⚠️ **THERE ARE TWO ARRAYS AND
RE-STAMPING DOES NOT CHECK THAT THEY AGREE.** `CREDENTIALS.memberships`
feeds `/about/`'s visible list and `/bio/`; **`MEMBERSHIP_ORGS` feeds
`/process/` §Confidentiality and the `memberOf` triples**, and `site.ts`
records that the two differ on three of four lines. `_MembershipParity`
compares their lengths only, so a substitution passes `npm run check` in
silence. An earlier form of this line said `schema.ts` emitted from the
same constant (`adversarial-reviewer`, round 1).
**RE-ARM THIS FOR THE NEXT REPUBLISH — the row does not close.** `AGENTS.md`
§12 **R10**, which is an **event trigger and cutover is one of its two
events.** Q44 closed 2026-08-28 and the group is published on `/about/`
(ADRIC, ADRIO, the three OBA sections, the CTF, `[verified 2026-08-28 —
Pouya]`), so this item is no longer "publish them" — it is **"ask him
@@ -572,15 +679,24 @@ the decision is re-readable rather than re-litigated.
**§4 records yearly renewal for the OBA sections and the CTF only** — it
says nothing about ADRIC's or ADRIO's period, and an earlier version of
this line asserted "all renew yearly", which §4 does not support.
⚠️ **STILL OPEN AS AT 2026-09-02 AND IT IS A ONE-LINE ANSWER.** Pouya was
asked on 2026-09-02. It is **one of three** items waiting on him that are
not waiting periods — the other two are Q63(a)'s wording approval and his
own read-through, both above; the earlier form of this line called it the
only one, in a change set that added the other two
(`adversarial-reviewer`, round 2). The question: *"are ADRIC, ADRIO, the three OBA sections and the
CTF all still current?"* Answer it, then re-stamp §4 and `schema.ts` with
the cutover date. Do not tick this from the 2026-08-28 stamp — a stamp is
not a renewal receipt, which is the whole of R10.
⚠️ **ASKED AND ANSWERED ON 2026-09-02 — that is why this is ticked, and
the distinction is the whole of R10.** It was ticked against a fresh
one-line confirmation from Pouya, not against the 2026-08-28 stamp: *a
stamp is not a renewal receipt.* The question to ask next time is
unchanged — *"are ADRIC, ADRIO, the three OBA sections and the CTF all
still current?"* — and the answer is followed by re-stamping **all four
stamp-bearing sites**: §4, `src/data/site.ts`, `src/data/schema.ts` and
**`src/pages/about.astro`**, which is the page that renders the group and
is therefore the file an editor most plausibly reads to check currency.
⚠️ **It was missing from this list and carried a stale date in the present
tense** (`adversarial-reviewer`, round 2).
⚠️ **NO RUNNING TALLY OF WHAT WAITS ON POUYA IS KEPT HERE ANY MORE.** This
line said "the only cutover item", was corrected to "one of three", and was
then rewritten as "the one item still waiting… is his own read-through" **in
the same change set that opened Q64** — wrong three times, in the same
direction each time: a count written while the change set was still adding
items. **The checkbox column is the tally.** Unticked items above are what
waits on him.
- [x] ✅ **THE SEVEN VOLATILE `docs/reference/` EXTRACTS RE-CHECKED — `AGENTS.md`
§12 R18, whose trigger is the same "before any cutover" event R10 uses.** ⚠️ **THIS ITEM DID NOT EXIST UNTIL 2026-09-02 AND THAT
WAS THE DEFECT**: R18 names a cutover as its trigger and the cutover
docs/reference/intake-table-access-verification.md
+123 -28
View File
@@ -26,26 +26,49 @@ trusting this file; it is dated for that reason.
2026-09-01, applied 2026-09-02). Option 2 below is the one taken; option 1 was
declined. `lars`'s membership of `admins` is **unchanged**.
**The shipped sentences**, so this file can be compared against the live page
rather than against a struck one:
⚠️ **AND THEN RULED AGAIN THE SAME DAY — §9 Q63, and the second ruling is the
one this file most needs to carry, because THIS FILE SUPPLIED THE ERROR.** The
first shipped sentence was *"Two people can"*, and it was read straight off the
enumeration below. **Pouya's attestation, 2026-09-02:** *"two people is an
exaggeration… a handful is accurate — the simulation counts identities, not
humans, and the two are not the same claim."*
> Two people can. The table sits in an Amazon Web Services account that also
> runs systems unrelated to this practice, and that account has two
> administrators — me, and one other person who administers it with me.
> Administrative access to the account carries the ability to read the table, so
> both of us can read what you send.
**The enumeration is exhaustive and the inference off it was not.** Every read
path terminates at `user/pouya` or `user/lars`; how many **people** can reach
those two credentials is not something `simulate-principal-policy` can see, so
the identity count is a **lower bound on people** and the page published it as an
exact count. **No numeric human headcount may ship.** The identity counts in this
file are unaffected and stay exactly as measured — this is a correction to what
may be *concluded* from them, not to any of them.
> No one outside those two people has been granted access to the table, and that
> is measured rather than assumed: every user and every role in the account was
> simulated against this table, and the only ones that come back able to read it
> lead to those same two people.
**The shipped sentences as at 2026-09-02**, so this file can be compared against
the live page rather than against a struck one:
> The account's administrators can — me, and the small number of people who
> administer it with me. The table sits in an Amazon Web Services account that
> also runs systems unrelated to this practice, and administrative access to that
> account carries the ability to read the table. That is who can read the stored
> record; who reads the notification email is a separate question, answered in the
> last paragraph of this section.
> The access itself is measured rather than assumed: every user and every role in
> the account was simulated against this table, and every identity that comes back
> able to read it is reachable only by those administrators. The account has no
> single sign-on and no federated login configured, and the table carries no
> policy of its own granting access to anyone. The account's root credential — the
> one path no policy constrains — has no programmatic key, and I hold it.
> The function that receives the form **can only add a record — it cannot read
> the table back.** And the credential that publishes this website has **no
> access to the table at all**, for reading or for writing.
**Wording is subject to Pouya's read-through approval** — §9 **Q63**, with a
`TODO(pouya)` beside the copy. The measurement is settled; the phrasing is not.
**The wording was approved by Pouya on 2026-09-02 with two trims** (§9 Q63(a)) —
the editorial closing sentence struck, and the mailbox clause rewritten because
`info@smlcompany.ca` is **a delegated mailbox read by Pouya and administrative
staff**, not a personal one (Q63(b); the fact is in `AGENTS.md` §7). **`33` was
deliberately not published**: a role total moves when AWS creates a service-linked
role by itself, and *"every user and every role in the account"* carries the
exhaustiveness without putting a second self-staling number on a legal page.
⚠️ **AND THE ENUMERATION BELOW WAS NOT ENOUGH TO SUPPORT THE SECOND OF THOSE
SENTENCES. See the addendum at the foot of this file**, which is what the page
@@ -289,8 +312,36 @@ many roles exist but which *people* they lead back to.
`[verified 2026-09-02]`. So "every user and every role" is not leaving out a
federated principal, because there is none to leave out.
Every read path therefore terminates at `pouya` or `lars`. **The count of people
is two, and it is now the result of an enumeration rather than of a policy name.**
- ⚠️ **AND THE `sso-admin` ZERO NEEDED A SECOND COMMAND TO MEAN ANYTHING, added
2026-09-02 (round 2).** `list-instances` answers about the account it is called
in, so a **member of an AWS Organization returns 0 while Identity Center runs in
the management account** — the zero would have been true and the conclusion
false. `aws organizations describe-organization` returns
**`AWSOrganizationsNotInUseException`: "Your account is not a member of an
organization"** `[verified 2026-09-02]`, so there is no management account above
this one and the zero is conclusive. Command 8.
- **The table carries NO RESOURCE-BASED POLICY OF ITS OWN**, and this is now a
command rather than an assertion. `aws dynamodb get-resource-policy` returns
**`PolicyNotFoundException`** `[verified 2026-09-02]` — exit **254**, the error
on stderr being the result. ⚠️ **A DynamoDB resource policy is invisible to
`describe-table`**, so no earlier command in this file could have seen one, and
`/legal/privacy/` publishes the claim (*"the table carries no policy of its own
granting access to anyone"*). It is the identity-policy enumeration's blind
spot: every simulation here asks what a **principal** may do, and a resource
policy grants from the other side. Found unbacked by `adversarial-reviewer`
round 2, on §10's own precedent — the client-backup bucket, where
`get-bucket-policy` returning `NoSuchBucketPolicy` was recorded because *"a
policy read alone could not have established the second half."* Command 7.
Every read path therefore terminates at `pouya` or `lars`. ⚠️ **AND THAT IS
WHERE THIS FILE WENT WRONG, SO THE CORRECTION SITS AT THE SENTENCE THAT CAUSED
IT.** This read *"The count of people is two, and it is now the result of an
enumeration rather than of a policy name"* until 2026-09-02, and `/legal/privacy/`
published that count. **It is a count of IDENTITIES.** Two credentials is a lower
bound on the number of people who can use them, and Pouya's attestation is that
*"a handful"* is the true figure (§9 Q63). The enumeration stands exactly as
measured; **an enumeration of principals is not a census.**
**The account root user, recorded because an enumeration that quietly omits it is
not an enumeration.** Root is not an IAM user and does not appear in
@@ -298,13 +349,30 @@ not an enumeration.** Root is not an IAM user and does not appear in
always read the table. Two facts bound it: `get-account-summary` reports
`AccountAccessKeysPresent: 0`, so **there is no programmatic root credential**,
and `AccountMFAEnabled: 1`. Root access therefore requires the root password and
its MFA device. **The page does not mention root and should not**: an account
owner's own credential is inherent to every cloud account and is not a third
party who has been granted access — which is why the shipped sentence is scoped
to *"every user and every role"* and to who has been *granted* access, rather
than to a bare "nobody else can". Who holds the root credentials is not
established in this repository; it is not a page-blocking fact, and it is noted
here rather than guessed at.
its MFA device.
⚠️ **THIS PASSAGE SAID *"The page does not mention root and should not"*, AND
THAT JUDGEMENT IS SUPERSEDED — §9 Q63(c), 2026-09-02.** It was reasoned from its
own last clause: *"Who holds the root credentials is not established in this
repository."* **Pouya established it on 2026-09-02: he holds it**
`[verified 2026-09-02 — Pouya]`. With the holder known, mentioning root
**strengthens** the paragraph rather than opening a hole in it — it closes the
one path a careful reader would ask about after being told every user and every
role was simulated. The page now states that the root credential has no
programmatic key and that he holds it; it does not state a headcount for it, and
`AGENTS.md` §7 carries the fact with §12 R21's trigger on it. ⚠️ **AND THE
ATTESTATION IS *held by Pouya*, NOT *held ONLY by Pouya* — §9 Q64 is open on
exactly that gap.** Nothing here excludes a second holder: root cannot be
simulated, and `get-account-summary` reports only that there is no access key and
that MFA is on. The shipped possessive sits one paragraph below *"the small
number of people who administer it with me"*, where a reader takes it as sole
custody. **This is the identity/human error of Q63 pointing the other way** — one
line from Pouya either arms it or strikes the possessive. The rest of the
original reasoning holds and is why the sentence is still scoped the way it is:
an account owner's own credential is inherent to every cloud account and is not a
third party who has been granted access, which is why the shipped sentence is
scoped to *"every user and every role"* and to who has been *granted* access
rather than to a bare "nobody else can".
**Two page sentences are now supported that were not before.**
@@ -347,8 +415,14 @@ a variable, which is the whole point above.
```bash
# 1. Inline policies — the command the original block never ran.
# ⚠️ THE `grep -v` IS THE ORIGINAL DEFECT AND IS KEPT ONLY TO SHOW IT. It
# excluded the 7 service-linked roles from a claim written as "every role", and a
# service-linked role for a backup or migration service CAN read table contents.
# For a full run, DELETE the grep -v — all 33 must be screened, which is what the
# 2026-09-02 addendum measured and what the page's "every user and every role"
# now rests on.
aws iam list-roles --query 'Roles[].RoleName' --output text \
| tr '\t' '\n' | grep -v '^AWSServiceRole' \
| tr '\t' '\n' \
| while IFS= read -r R; do
aws iam list-role-policies --role-name "$R" --query 'PolicyNames' --output text
done
@@ -391,10 +465,31 @@ aws iam list-open-id-connect-providers --query 'length(OpenIDConnectProviderList
aws sso-admin list-instances --query 'length(Instances)'
aws iam get-account-summary \
--query 'SummaryMap.{AccessKeysPresentRoot:AccountAccessKeysPresent,MFA:AccountMFAEnabled}'
# 7. The table's OWN policy. ⚠️ NOT VISIBLE IN describe-table — a DynamoDB
# resource policy needs its own call, and the page publishes a claim about it.
# A "no policy" answer arrives as a NON-ZERO EXIT with PolicyNotFoundException
# on stderr, so do not suppress stderr and do not read exit 0 as the result.
aws dynamodb get-resource-policy \
--resource-arn 'arn:aws:dynamodb:ca-central-1:327082975128:table/adr-intake-submissions'
# 8. Is the account in an AWS Organization? ⚠️ THIS IS WHAT MAKES COMMAND 6's
# sso-admin ZERO CONCLUSIVE. `list-instances` answers about THIS account, so a
# member account returns 0 while Identity Center runs in the management
# account. Not-in-an-org means there is no such management account.
aws organizations describe-organization
```
**Five user rows and twenty-six role rows, or the run did not happen.** And for
every simulation: **seven decisions per role call, six per CDK-path call, two
per-resource decisions per assume call** — the counts are the assertion, because
a call that silently received one bogus action name answers `implicitDeny` and
reads exactly like a clean row.
**Five user rows and THIRTY-THREE role rows, or the run did not happen.** ⚠️
**This said "twenty-six" until 2026-09-02, which made an INCOMPLETE sweep pass
its own acceptance test** — the number matched command 1's `grep -v
'^AWSServiceRole'`, so an operator following §12 R21's instruction to re-run this
file would have reproduced the exclusion and got the pass line for it. The page's
*"every user and every role"* rests on 33 of 33. `adversarial-reviewer`, round 2.
And for every simulation: **seven decisions per role call, six per CDK-path call,
two per-resource decisions per assume call** — the counts are the assertion,
because a call that silently received one bogus action name answers
`implicitDeny` and reads exactly like a clean row. **Commands 7 and 8 are read by
their ERROR, not their output**: `PolicyNotFoundException` and
`AWSOrganizationsNotInUseException` are each the clean result, arriving on stderr
with a non-zero exit.
scripts/check-claims.mjs
+25 -15
View File
@@ -415,27 +415,37 @@ const FIXTURES = {
the wording a correction is likely to reach for. Where a fixture is one of
those, the comment beside it says so. */
mustNotMatch: [
/* NEGATIVE FIXTURES FOR `sole-administrator-q62`. The first three are the
REPLACEMENT COPY ITSELF, verbatim from the corrected `/legal/privacy/` —
/* NEGATIVE FIXTURES FOR `sole-administrator-q62`. The first SEVEN are LIVE
PAGE COPY, verbatim from the corrected `/legal/privacy/` —
which is the fixture that matters, because Q62's ruling required this
pattern to be proven silent on the true sentence as well as loud on the
false one. THEY MUST BE RE-SYNCED WHENEVER THAT COPY CHANGES — round 1's
set went stale within the hour, when the audit rewrote three of the four
paragraphs they were copied from. The rest are near misses on the same
subject: the pattern is anchored on five strings that reached `dist/`, not
on the ideas in them, so a truthful sentence about administrative access
must pass. */
'Two people can. The table sits in an Amazon Web Services account that also runs systems unrelated to this practice, and that account has two administrators — me, and one other person who administers it with me.',
'No one outside those two people has been granted access to the table, and that is measured rather than assumed: every user and every role in the account was simulated against this table, and the only ones that come back able to read it lead to those same two people.',
false one. THEY MUST BE RE-SYNCED WHENEVER THAT COPY CHANGES — this set
has now gone stale twice, once within the hour of being written and again
when Pouya's 2026-09-02 ruling took the human headcount off the page. The
rest are near misses on the same subject: the pattern is anchored on five
strings that reached `dist/`, not on the ideas in them, so a truthful
sentence about administrative access must pass. */
"The account's administrators can — me, and the small number of people who administer it with me. The table sits in an Amazon Web Services account that also runs systems unrelated to this practice, and administrative access to that account carries the ability to read the table. That is who can read the stored record; who reads the notification email is a separate question, answered in the last paragraph of this section.",
'The access itself is measured rather than assumed: every user and every role in the account was simulated against this table, and every identity that comes back able to read it is reachable only by those administrators.',
"The account's root credential — the one path no policy constrains — has no programmatic key, and I hold it.",
'Two things in the system are narrower than I am, and they are worth stating because they are the part you cannot check for yourself.',
'No one else is sent it. There is no CRM, no mailing list and no analytics on the submission.',
'Which means there are three copies, not one. The notification in my own mailbox, which is on Google Workspace — so Google holds a copy of whatever you sent me, and so does anyone who can reach that mailbox.',
/* The replacement summary, which must not trip the third-surface alternative. */
'Which means there are three copies, not one. The record in the table, which the two people above can read.',
"There are therefore three copies of what you send. The record in the table, which the account's administrators can read.",
"The notification, which lands in the practice's mailbox — read by me and by administrative staff — on Google Workspace, so Google holds a copy of whatever you sent me.",
'No one else is sent it. There is no CRM, no mailing list and no analytics on the submission.',
'The table is reachable by the function that writes to it.',
'Two accounts hold administrative access to the AWS account, and the function that writes to the table cannot read it.',
'Nobody else has access to my mailbox.',
'There is no team. Every inquiry is read by me.',
/* ⚠️ TWO FIXTURES WERE REMOVED FROM HERE ON 2026-09-02 AND THE REASON
MATTERS MORE THAN THE STRINGS: `'Nobody else has access to my mailbox.'`
and `'There is no team. Every inquiry is read by me.'` They were added as
harmless near-misses, and §7's `info@smlcompany.ca` row then established
that the mailbox is DELEGATED — Pouya and administrative staff — which
makes both FALSE. The second is also a paraphrase of a `mustMatch` breach
string. This list is documented as the copy the site legitimately
publishes, so a maintainer reaching for a tidier answer would have found
one here, which is how this page acquired its false sentence the first
time. Removing a false fixture keeps the list true; it is not a coverage
change and the freeze does not reach it. `adversarial-reviewer`, round 1. */
'I act as a neutral. I do not act for a party in a matter I take, and each party should have their own legal advice.',
'I run a process, I do not run a case for anybody in it.',
'I will not run a process whose shape nobody agreed to in advance.',
src/data/schema.ts
+5 -1
View File
@@ -124,7 +124,11 @@ export function personNode(
R10 fires on an event, not a date: re-confirm before any cutover or major
republish, and re-stamp §4. That covers this field as well as the visible
list. */
list. **Last fired 2026-09-02** — all four re-confirmed by Pouya on the day
of cutover. ⚠️ **The stamp lives on `CREDENTIALS.memberships` in site.ts
and THIS FIELD READS `MEMBERSHIP_ORGS`** — a different array, as the note
seven lines above says. Content parity between them is manual, so
re-stamping is not the same act as re-checking that the two agree. */
...(opts.memberships
? {
memberOf: MEMBERSHIP_ORGS.map((name) => ({
src/data/site.ts
+9 -5
View File
@@ -75,9 +75,10 @@ export const CREDENTIALS = {
],
languages: ['English', 'Farsi'],
/**
* [verified 2026-08-28 — Pouya, AGENTS.md Q44] — re-stamped when Q44 closed;
* the original confirmation was 2026-08-26 (Q28 plus the CTF addition of the same
* date] — and FOR NOW.
* [verified 2026-09-02 — Pouya, R10's cutover fire] — re-confirmed on the day
* of cutover: ADRIC, ADRIO, the three OBA sections and the CTF all current.
* Earlier stamps: 2026-08-28 (Q44), 2026-08-26 (Q28 plus the CTF addition of
* the same date). AND FOR NOW — the stamp is a snapshot, not a warranty.
*
* WHAT §4 ACTUALLY SAYS ABOUT RENEWAL, because a widened version of it reached
* a public page. §4, quoted exactly: *"the OBA sections and the CTF renew
@@ -95,8 +96,11 @@ export const CREDENTIALS = {
*
* **PUBLISHED FROM 2026-08-28 — Q44 CLOSED.** Pouya re-confirmed all four as
* current, which discharges R10's prohibition, and `/about/` now renders a
* Memberships group from this array. Re-stamped `[verified 2026-08-28 —
* Pouya]`; the earlier stamp was 2026-08-26.
* Memberships group from this array.
*
* **RE-CONFIRMED 2026-09-02 — R10's cutover event, and that is the stamp
* above.** R10 fires on an event and cutover is one of its two; a stamp is not
* a renewal receipt, so this was asked again rather than read again.
*
* ⚠️ **RENDER THE LIST; NEVER RENDER A CLAIM ABOUT ITS CURRENCY.** No
* "renewed annually", no "current as of", no "listed as current", no stamp
src/pages/about.astro
+9 -2
View File
@@ -203,8 +203,15 @@ const designationLine = [
*
* **Q44 closed 2026-08-28.** Pouya re-confirmed all four as current — ADRIC,
* ADRIO, the three OBA sections, and the Canadian Tax Foundation — which
* discharges R10's prohibition and puts the group back on the page. §4 is
* re-stamped `[verified 2026-08-28 — Pouya]`.
* discharges R10's prohibition and puts the group back on the page.
*
* **RE-CONFIRMED AGAIN 2026-09-02 — R10's cutover fire.** All four current;
* §4 and `CREDENTIALS.memberships` re-stamped `[verified 2026-09-02 — Pouya]`.
* ⚠️ **THIS COMMENT IS A FOURTH STAMP-BEARING SITE and it carried the
* 2026-08-28 date in the present tense after the re-stamp** — `docs/06`'s R10
* instruction named three files and not this one, so the next fire would have
* missed it again (`adversarial-reviewer`, round 2). The instruction now names
* four.
*
* **DO NOT ADD A CURRENCY SENTENCE.** Not "renewed annually", not "current as
* of", not "listed as current", not a stamp date in the markup. His ruling is
src/pages/legal/privacy.astro
+75 -78
View File
@@ -182,31 +182,18 @@ const COLLECTED = INTAKE_FIELDS.map((field) => field.label);
<p>
In a DynamoDB table in Amazon Web Services' Canada Central region, in
Canada. It is encrypted at rest. Two emails are sent when you submit
the form — a notification to me and a confirmation to you — using
Amazon Simple Email Service, also in the same Canadian region.
the form — a notification to the practice and a confirmation to you —
using Amazon Simple Email Service, also in the same Canadian region.
</p>
{
/* ⚠️ THIS PARAGRAPH REPLACED A FALSE ONE, AND IT IS THE MOST SERIOUS
THING FOUND IN THE STEP 7–10 REVIEW. It read: *"Amazon Web Services
is therefore a processor for this information. **No other third party
receives it.**"*
`AGENTS.md` §7 records mail hosting as **Google Workspace**, and D18
sends the notification to `info@smlcompany.ca`. So Google receives and
stores every submission — including the names of opposing parties and
their counsel, which is the most sensitive thing this form collects —
as a mail processor. The page's own next section already admitted it:
*"The notification sits in my mailbox."* That mailbox is Google's.
A reader making a PIPEDA access request was being told there was one
processor when there are two. This page's header comment sets the
standard the sentence failed: a statement that describes an intended
control rather than a real one is a false statement to the public in
a legal document, and it fails silently, because nothing breaks and
the sentence reads correctly.
Found by `adversarial-reviewer`, 2026-08-31. §7 is cited rather than
restated — no MX record here. */
/* ⚠️ TWO PROCESSORS, AND BOTH MUST BE NAMED. `AGENTS.md` §7 records
mail hosting as **Google Workspace** and D18 sends the notification to
`info@smlcompany.ca`, so Google receives and stores every submission —
including the opposing parties and their counsel, the most sensitive
thing this form collects. A reader making a PIPEDA access request
needs both names. This paragraph replaced one asserting *"No other
third party receives it"*; see entry (ao). §7 is cited, not restated —
no MX record here. */
}
<p>
Two companies therefore process it, and both are named because a
@@ -214,9 +201,10 @@ const COLLECTED = INTAKE_FIELDS.map((field) => field.label);
>Amazon Web Services</strong
> stores the submission and sends the two emails, in Canada. <strong
>Google</strong
> receives the notification email, because my own mail is on Google Workspace
— so a copy of what you send, including any names you give me, sits in that
mailbox. If you reply to the confirmation, that reply goes there too.
> receives the notification email, because the practice's mail is on Google
Workspace — so a copy of what you send, including any names you give me,
sits in that mailbox. If you reply to the confirmation, that reply goes
there too.
</p>
<p>
The confirmation sent to you is delivered to whoever runs your email.
@@ -250,56 +238,67 @@ const COLLECTED = INTAKE_FIELDS.map((field) => field.label);
than necessary for that purpose.
</p>
<p>
Emails are a separate matter. The notification sits in my mailbox and
the confirmation sits in yours, and neither is deleted by that
mechanism.
Emails are a separate matter. The notification sits in the practice's
mailbox and the confirmation sits in yours, and neither is deleted by
that mechanism.
</p>
<h2>Who can see it</h2>
{
/* ⚠️ FIVE PARAGRAPHS ANSWER "WHO CAN SEE IT" AND THEY CHANGE
TOGETHER: this section's four — the count, the measured enumeration,
the two narrow credentials, the three copies — and §Where it is
stored's last one. Every defect here has been a partial sweep of that
set, and there have been four.
**The enumeration paragraph is the one that goes stale on its own**,
because it is a claim about the present state of an AWS account: §12
**R21** is its trigger, and
/* ⚠️ THESE NINE PARAGRAPHS ANSWER "WHO CAN SEE IT" AND THEY CHANGE
TOGETHER — by opening phrase, because every defect here has been a
partial sweep and a COUNT is what drifts. **This section:** "The
account's administrators can", "The access itself is measured", "Two
things in the system are narrower", "There are therefore three
copies". **§Where it is stored, all four:** "In a DynamoDB table",
"Two companies therefore process it", "The confirmation sent to you",
"No one else is sent it". **§How long it is kept:** "Emails are a
separate matter".
**NO HUMAN HEADCOUNT SHIPS** — Pouya, 2026-09-02: the simulation
counts identities, not people. Say "the account's administrators".
**TWO CLAIMS GO STALE ON THEIR OWN**, both about the present state of
systems outside this repo: the AWS enumeration and who reads
`info@smlcompany.ca`. Their durable homes are `AGENTS.md` §7's two
rows and §12 **R21** claims (i)–(v), which is the trigger for both;
`docs/reference/intake-table-access-verification.md` holds the
commands. `check-claims.mjs`'s `sole-administrator-q62` pattern is a
permanent bar on the old shape returning (Pouya, ruled 2026-09-01). */
}
{
/* TODO(pouya): TWO THINGS, BOTH FOR YOUR READ-THROUGH — §9 Q63.
(1) APPROVE THE WORDING BELOW. Your ruling settled what it must say;
you reserved the wording. Nothing else gates it.
(2) WHO ELSE CAN READ `info@smlcompany.ca`? The paragraph below says
"anyone who can reach that mailbox", which is true whatever the
answer — but §7 records the mail host and the SES identities and NOT
the mailbox's access list, so this repository cannot state the
number a reader of a privacy policy is entitled to. If the Workspace
is administered by anyone else, or the address is a shared alias,
say so and this becomes specific like the table sentence above it.
Raised by `claims-auditor` and `adversarial-reviewer`, D20 cutover
pass, 2026-09-02. */
commands. **§9 Q63 is closed — the live gate is Q64.**
`check-claims.mjs`'s `sole-administrator-q62` pattern bars the OLD
false shape permanently and is blind to both. */
}
<p>
Two people can. The table sits in an Amazon Web Services account that
also runs systems unrelated to this practice, and that account has two
administrators — me, and one other person who administers it with me.
Administrative access to the account carries the ability to read the
table, so both of us can read what you send. I would rather tell you
that than give you the tidier answer.
The account's administrators can — me, and the small number of people
who administer it with me. The table sits in an Amazon Web Services
account that also runs systems unrelated to this practice, and
administrative access to that account carries the ability to read the
table. That is who can read the stored record; who reads the
notification email is a separate question, answered in the last
paragraph of this section.
</p>
<p>
No one outside those two people has been granted access to the table,
and that is measured rather than assumed: every user and every role in
the account was simulated against this table, and the only ones that
come back able to read it lead to those same two people. Amazon Web
Services operates the table, as <em>Where it is stored</em> above says —
The access itself is measured rather than assumed: every user and
every role in the account was simulated against this table, and every
identity that comes back able to read it is reachable only by those
administrators. The account has no single sign-on and no federated
login configured, and the table carries no policy of its own granting
access to anyone. The account's root credential — the one path no
policy constrains — has no programmatic key, and I hold it. Amazon Web
Services operates the table, as <em>Where it is stored</em> above says:
a company that runs a database is not someone who has been given access
to it, and both of those are true at once.
</p>
{
/* TODO(pouya): DOES ANYONE ELSE HOLD THE ROOT PASSWORD OR ITS MFA
DEVICE? `AGENTS.md` §9 **Q64**. You attested that you hold it
(Q63(c)) and the paragraph above ships your words — *"has no
programmatic key, and I hold it"* — which is true whether or not
somebody else holds it too. ⚠️ **But it sits one paragraph below "the
small number of people who administer it with me", and a reader takes
it as SOLE custody.** Nothing measured establishes that: root is not
an IAM principal, cannot be simulated, and `get-account-summary`
reports only that there is no access key and that MFA is on. If it is
sole custody, say so and §12 R21 arms it; if it is not, the possessive
comes out. One line either way. `adversarial-reviewer`, round 1. */
}
<p>
Two things in the system are narrower than I am, and they are worth
stating because they are the part you cannot check for yourself. The
@@ -310,23 +309,21 @@ const COLLECTED = INTAKE_FIELDS.map((field) => field.label);
writing.
</p>
{
/* ⚠️ THREE COPIES, NOT TWO, AND THE THIRD IS THE READER'S OWN. This
said "the one other place a copy exists" and named only my mailbox —
while the handler puts the whole submission into the confirmation it
sends the inquirer, under "What you sent:" (the second
`SendEmailCommand` in `backend/intake/handler.mjs`). So a copy sits
with the reader's provider, which §Where it is stored already tells
them. An absolute enumeration standing one section from the page's
own counter-example is what Q62 was; this is the same shape and it
was introduced by Q62's own fix. Found by `claims-auditor`. */
/* ⚠️ THREE COPIES, NOT TWO, AND THE THIRD IS THE READER'S OWN: the
handler puts the whole submission into the confirmation it sends the
inquirer, under "What you sent:" (the second `SendEmailCommand` in
`backend/intake/handler.mjs`). Do not write "the one other place a
copy exists" — an absolute enumeration standing one section from the
page's own counter-example is what Q62 was. */
}
<p>
There are therefore three copies of what you send. The record in the
table, which the two people above can read. The notification in my own
mailbox, which is on Google Workspace — so Google holds a copy of
whatever you sent me, and so does anyone who can reach that mailbox.
And the confirmation that went to you, which sits with whoever runs
your email; that copy is in your hands rather than mine.
table, which the account's administrators can read. The notification,
which lands in the practice's mailbox — read by me and by
administrative staff — on Google Workspace, so Google holds a copy of
whatever you sent me. And the confirmation that went to you, which
sits with whoever runs your email; that copy is in your hands rather
than mine.
</p>
<h2>Cookies and analytics</h2>