2 Commits

Include renames

Author	SHA1	Message	Date
Pouya LajevardiandClaude Opus 5	02739adac9	fix: refute (ar)'s intake finding; fix the D20 gloss class; add X-Robots-Tag on *.pdf ... Pouya's rulings of 2026-09-03, in five parts. 1. THE INTAKE FORM IS NOT BROKEN. (ar) was wrong. docs/09 §7.1 verbatim — POST /api/intake with an Origin header — returns 303 to /contact/could-not-send/ with access-control-allow-origin echoed; the same probe without Origin returns 403. A bare POST 403s BY DESIGN and §7.1 says so three lines below the probe it prescribes: "403 means the Origin header did not arrive". The earlier finding read a status code without reading the document that defines it. Second time in two days. CLAUDE.md's instrument list goes eight to nine. D20 findings 12 and 19 fall with it; §7.2 (that both emails arrive) is still owed. The correction is APPENDED as entry (as); (ar) stands unedited. 2. The privacy retention comment was stale, not a defect — superseded by his decision to publish and confirm after launch, reading from 2026-09-04. Reworded; the TODO(pouya) came off with the gate it enforced. The mechanism finding survives: it was a JSX comment, stripped by Astro, so no build or deploy path could see it. A publication gate that lives only in a stripped comment is not a gate. §9 Q60 corrected. 3. The gloss class is fixed — 15 of the 20 D20 findings, 14 distinct edits across 9 files, under the rule "the gloss may say no more than the extract says; no new claims, no new sources". Swept three unpublished insights drafts too, and corrected the wrong CAA attribution at its source in docs/reference/, which is where a fixed page re-seeds. /bio/ changed, so the committed PDF is regenerated (89,549 B, 1 page asserted). Three findings outstanding: 10 needs a ruling, 11 is ruled and owed via Q60, 13 needs him to have said it. R1 is not one of the twenty. 4. X-Robots-Tag cannot be done with S3 object metadata — --metadata writes user metadata, returned as x-amz-meta-x-robots-tag, which no crawler reads. Built as the CloudFront response-headers policy docs/06 has specified all along: configure.mjs section 4. It needs a --apply run, not a deploy. The policy is cloned from whatever is attached at run time and reconciled on every run, because a response-headers policy replaces rather than merges. 5. Headshot deferred as an open non-defect. The master and the srcset ladder are both fine; Astro passes no quality, so AVIF encodes at sharp's default 50 and is served first. Two review rounds, 29 findings, all resolved, none declined; stopped at two per D19. NINE of round 2's fourteen were defects in round 1's own repairs — including a fix that harmonised both /fees/ rows onto wording that was itself unregistered, publishing an unsourced fee term twice where it had been once. Gates, exit status read for each: check 0 (0 errors, 0 warnings, 0 hints), build 0 (23 pages), check:claims 0, check:intake 0, og:proof 0, lint 0, minifier grep exit 1, router.test.mjs 30/30. Lighthouse NOT run. Nothing deployed and nothing applied to the distribution. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5	2026-09-03 17:23:20 -04:00
Pouya LajevardiandClaude Opus 5	bd282aa47d	feat: production run — Q61 ramp, /404/, CloudFront router, cutover runbook ... Five items of Pouya's production run, 2026-09-01. Q61 — scroll-padding-top becomes a max() ramp on `10lh - 83px`, with the plain calc() first as the fallback for engines without `lh`. Hidden focus stops under minimumFontSize=32: 290 of 1,455 -> 0, control build still 290. Default settings byte-identical (0 differences over 352 page-widths x 17 fields). The 12 residual cells at minimumFontSize=16/20 are pre-existing and unchanged-or-better; reported, not widened, per instruction. Intake backend + CloudFront — docs/09-cutover-runbook.md is the copy-paste sequence for admin execution: every command followed by its verification and expected output, rollback per part, and Part 10 is Q60's TTL test. infra/cloudfront/router.js is the trailing-slash function (30-case suite; 8 fail against the pre-review version, incl. a protocol-relative open redirect). infra/cloudfront/configure.mjs is dry-run-by-default and idempotent. scripts/intake-env.mjs emits the six Lambda env vars from src/data/site.ts. Four launch blockers found by reading the running system: - handler.mjs wrote pk/sk; the live table's key is submissionId with no sort key, so every submission would have failed validation silently - the Lambda invoke permission is scoped to the old route path - 22 of 23 pages 403 without the router function - there was no 404 page; src/pages/404.astro adds it Claims audit (D20 cutover pass) — five gloss over-reaches corrected on /practice/energy/, /practice/insurance/ (x2), /practice/technology/ and /med-arb/. Three findings left open for Pouya: Q62, the /med-arb/ gloss, and Q60. Q62 — one frozen-tripwire pattern added under the freeze's own breach exception, with a probe and four negative fixtures. check:claims exits 1 until the false /legal/privacy/ sentence is corrected, so both deploy paths are blocked by a mechanism rather than by memory. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5	2026-09-02 06:52:20 -04:00