3 Commits

Include renames

Author	SHA1	Message	Date
Pouya LajevardiandClaude Opus 5	02739adac9	fix: refute (ar)'s intake finding; fix the D20 gloss class; add X-Robots-Tag on *.pdf ... Pouya's rulings of 2026-09-03, in five parts. 1. THE INTAKE FORM IS NOT BROKEN. (ar) was wrong. docs/09 §7.1 verbatim — POST /api/intake with an Origin header — returns 303 to /contact/could-not-send/ with access-control-allow-origin echoed; the same probe without Origin returns 403. A bare POST 403s BY DESIGN and §7.1 says so three lines below the probe it prescribes: "403 means the Origin header did not arrive". The earlier finding read a status code without reading the document that defines it. Second time in two days. CLAUDE.md's instrument list goes eight to nine. D20 findings 12 and 19 fall with it; §7.2 (that both emails arrive) is still owed. The correction is APPENDED as entry (as); (ar) stands unedited. 2. The privacy retention comment was stale, not a defect — superseded by his decision to publish and confirm after launch, reading from 2026-09-04. Reworded; the TODO(pouya) came off with the gate it enforced. The mechanism finding survives: it was a JSX comment, stripped by Astro, so no build or deploy path could see it. A publication gate that lives only in a stripped comment is not a gate. §9 Q60 corrected. 3. The gloss class is fixed — 15 of the 20 D20 findings, 14 distinct edits across 9 files, under the rule "the gloss may say no more than the extract says; no new claims, no new sources". Swept three unpublished insights drafts too, and corrected the wrong CAA attribution at its source in docs/reference/, which is where a fixed page re-seeds. /bio/ changed, so the committed PDF is regenerated (89,549 B, 1 page asserted). Three findings outstanding: 10 needs a ruling, 11 is ruled and owed via Q60, 13 needs him to have said it. R1 is not one of the twenty. 4. X-Robots-Tag cannot be done with S3 object metadata — --metadata writes user metadata, returned as x-amz-meta-x-robots-tag, which no crawler reads. Built as the CloudFront response-headers policy docs/06 has specified all along: configure.mjs section 4. It needs a --apply run, not a deploy. The policy is cloned from whatever is attached at run time and reconciled on every run, because a response-headers policy replaces rather than merges. 5. Headshot deferred as an open non-defect. The master and the srcset ladder are both fine; Astro passes no quality, so AVIF encodes at sharp's default 50 and is served first. Two review rounds, 29 findings, all resolved, none declined; stopped at two per D19. NINE of round 2's fourteen were defects in round 1's own repairs — including a fix that harmonised both /fees/ rows onto wording that was itself unregistered, publishing an unsourced fee term twice where it had been once. Gates, exit status read for each: check 0 (0 errors, 0 warnings, 0 hints), build 0 (23 pages), check:claims 0, check:intake 0, og:proof 0, lint 0, minifier grep exit 1, router.test.mjs 30/30. Lighthouse NOT run. Nothing deployed and nothing applied to the distribution. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5	2026-09-03 17:23:20 -04:00
Pouya LajevardiandClaude Opus 5	6aaf089b05	feat: rule Q62 by stating the truth; strike the /med-arb/ gloss; re-stamp R18 ... Pouya's four rulings of 2026-09-01, applied 2026-09-02. Q62 — RULED "state the truth", not "remove the access". /legal/privacy/ now says two people can read the intake table, names their role, and adds the two stronger facts the false sentence had crowded out: the handler role holds PutItem only, and adr-sml-deploy is implicitDeny on all seven read and write actions. Wording is subject to Pouya's read-through — Q63(a), with a TODO(pouya) beside the copy. The ruling named one sentence; a vocabulary sweep found the falsehood in three places, and the audit then found two more. Five paragraphs now answer "who can see it" and change together. The tripwire stays permanently, per ruling, and grew from two alternatives to five. Every alternative is one string that reached dist/. Proven both ways against the pre-correction page rebuilt from bd282aa: exit 1 with 5 matches at dist/legal/privacy/index.html:54,67,67,68,72; exit 0 on the corrected page, self-test 12 patterns / 36 approved strings. /med-arb/ — the gloss is struck with no replacement, per ruling. The strike left "the section above" pointing at the ADRIC rule set and "the agreement" with no antecedent; both fixed. The bare designations line sitting under ADRIC's quoted competence requirement is also struck, which goes beyond the ruling and is flagged for Pouya. R18 — re-stamped, two-tier: (a)(c)(d) re-verified against a source, (b)(e)(f)(g) held on a cadence judgement. All seven hold, no shipped sentence changed. R18's trigger had NO cutover checklist item and had stamped five extracts of seven; both fixed. Candidate limb (h) flagged. R10 — fired and unsatisfied; left open on instruction. The evidence behind the new privacy sentence was weaker than the sentence. Re-measured: 33 of 33 roles simulated (23 of 26 carried inline policies nobody had read; the two CDK lookup roles can read the table), four trust policies, the CloudFormation escalation path for all five users, 0 federated providers, root recorded. Every read path terminates at the same two people. Two review rounds, 36 findings. 35 fixed, 1 declined. Five of round 2's were defects in round 1's own fixes; stopped at two per D19. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5	2026-09-02 07:59:50 -04:00
Pouya LajevardiandClaude Opus 5	bd282aa47d	feat: production run — Q61 ramp, /404/, CloudFront router, cutover runbook ... Five items of Pouya's production run, 2026-09-01. Q61 — scroll-padding-top becomes a max() ramp on `10lh - 83px`, with the plain calc() first as the fallback for engines without `lh`. Hidden focus stops under minimumFontSize=32: 290 of 1,455 -> 0, control build still 290. Default settings byte-identical (0 differences over 352 page-widths x 17 fields). The 12 residual cells at minimumFontSize=16/20 are pre-existing and unchanged-or-better; reported, not widened, per instruction. Intake backend + CloudFront — docs/09-cutover-runbook.md is the copy-paste sequence for admin execution: every command followed by its verification and expected output, rollback per part, and Part 10 is Q60's TTL test. infra/cloudfront/router.js is the trailing-slash function (30-case suite; 8 fail against the pre-review version, incl. a protocol-relative open redirect). infra/cloudfront/configure.mjs is dry-run-by-default and idempotent. scripts/intake-env.mjs emits the six Lambda env vars from src/data/site.ts. Four launch blockers found by reading the running system: - handler.mjs wrote pk/sk; the live table's key is submissionId with no sort key, so every submission would have failed validation silently - the Lambda invoke permission is scoped to the old route path - 22 of 23 pages 403 without the router function - there was no 404 page; src/pages/404.astro adds it Claims audit (D20 cutover pass) — five gloss over-reaches corrected on /practice/energy/, /practice/insurance/ (x2), /practice/technology/ and /med-arb/. Three findings left open for Pouya: Q62, the /med-arb/ gloss, and Q60. Q62 — one frozen-tripwire pattern added under the freeze's own breach exception, with a probe and four negative fixtures. check:claims exits 1 until the false /legal/privacy/ sentence is corrected, so both deploy paths are blocked by a mechanism rather than by memory. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5	2026-09-02 06:52:20 -04:00