6 Commits

Include renames

Author	SHA1	Message	Date
Pouya LajevardiandClaude Opus 5	610edc24fd	feat: Q.Arb is held; strike C.Med-Arb entirely; dissolve the paired disclosure ... Pouya's ruling, 2026-08-29. Treated as D3-class and swept accordingly. §4 Q.Arb becomes a HELD designation. Obtained July 2026 — recorded in the register, deliberately not published. Public copy carries "Q.Arb (ADRIC / ADRIO)" beside Q.Med and nothing more. Every stage form is struck: "commenced", "in progress", "pathway", "not yet". C.Med-Arb as a stated goal is struck. This DEVIATES FROM THE STRATEGY BRIEF, which made it "the explicit long-term professional narrative"; the brief is not in this repository, so the deviation is recorded in four places so nobody reinstates it from a document no reader can open. The designation stays in §11 as a definition — what is struck is its status as a goal of his. The paired-disclosure condition dissolves. It existed only because Q.Arb was in progress; there is no stage left to disclose, and a condition with no subject cannot be half-kept. Pages /about/'s credentialing arc is DELETED, not rewritten — two held designations are not a journey. /arbitration/ loses its stage section and its "Available now, and open about the stage" h1. /med-arb/'s endpoint section is rewritten. Deleting CREDENTIALS.goal/goalName rather than emptying them turned every consumer into a build error, which is how the last two surfaced. hasCredential now maps CREDENTIALS.designations instead of indexing [0]; _DesignationRowParity pins the visible credential row to the same constant. check:claims q-arb-as-a-stage (inverted from the predecessor, which barred Q.Arb reading as HELD) and c-med-arb-struck. Each page is now scanned twice — as published, and with inline tags collapsed — because [^<] cannot cross <strong>, which this site sets in prose. Two open questions for Pouya, neither blocking: Q55 — the acquisition date. §4 says obtained July 2026; the Change Log of 2026-08-26 records "commenced August 2026", both stamped [verified — Pouya]. They cannot both be true. Nothing published turns on it. Q56 — is the mediation offering scoped commercial? §4 leaves it unscoped; four surfaces say "commercial mediation"; /practice/insurance/ offers mediation in insured-versus-insurer SABS matters. Two review rounds, all findings applied or declined with a stated reason. Round 2 found ten lines in docs/03 still instructing the struck form — the 2026-08-29 sweep missed them because `git grep 'Q.Arb'` is line-anchored and the block never names it. Sweep the vocabulary, not only the subject. Gates, exit statuses read directly, never through a pipe: npm run check exit=0 (0 errors, 0 warnings, 0 hints) npm run lint exit=0 npm run build exit=0 (12 pages) npm run check:claims exit=0 (11 patterns, 26 approved strings) npm audit exit=0 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5	2026-08-30 10:37:19 -04:00
Pouya LajevardiandClaude Opus 5	79b19a7bd0	feat: build step 5 — /practice/ and six area pages; check:claims gates §4 in dist ... Step 5 ships /practice/ and the six practice-area pages (construction, technology, energy, insurance, shareholder, cross-border) from one route, and adds the mechanical §4 gate Pouya ruled for. check:claims — §4 Forbidden becomes a build error scripts/check-claims.mjs greps dist/**/*.html for 10 patterns, each carrying the incident that put it there. It strips <style> and non-JSON-LD <script> first (a bare sweep for "leading" returned 26 hits, 25 of them var(--leading-body)), self-tests every pattern against fixtures before sweeping, and refuses a missing, empty or stale dist/. Wired into /build Phase 5 and both deploy paths. Q54 — six conduct undertakings publish, and §4 gains a third class Conduct undertakings sit apart from credentials and offerings: the gate is that Pouya said it in terms. The strings live in CONDUCT_UNDERTAKINGS so a softening is one visible diff. (e) and (f) replace the third-person sentences already on /arbitration/ rather than joining them. Q49, Q50 recorded as rulings. §7 records the SES us-east-1 stray identity's deletion. R11 holds typescript at its current major, with the peer-range reason recorded. Three facts corrected, two of them already shipped - The LAT gloss said mediation "before filing and continuing after filing"; the Tribunal names mediation for "Before you apply" only and its second sentence is about negotiation. An ellipsis in docs/01 had deleted it. - "Connection allocation" is not an Ontario term. - "The 2026 privacy statute" does not exist — Bill C-27 died without royal assent. Struck from docs/03 rather than corrected in place. ADR Chambers struck from /arbitration/ and from docs/01 item 3 (Pouya, 2026-08-30): the source establishes what the firm publishes, not that an outside neutral can be appointed under its rules. claims-auditor gains a second lens — for every quoted source, whether the sentence beneath stays inside what the quotation establishes. Four shipped defects had that shape and none of them is greppable. CLAUDE.md gains a convention: never truncate the output of a check you intend to believe. `npm run check | tail -3` returns warnings, hints and a blank line and drops the errors line; it was reported as passing four times while astro check was exiting 1 with 10 type errors. Gates, exit status read directly, not through a pipe: npm run check exit=0 npm run lint exit=0 npm run build exit=0 npm run check:claims exit=0 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5	2026-08-30 09:35:26 -04:00
Pouya LajevardiandClaude Opus 5	7514a49803	feat: upgrade to Astro 7; harden the content schema; wire a11y linting ... Amends D1 to pin the major explicitly (v7.x) rather than inherit it. The ^5.0.0 pin was recalled rather than checked and was two majors stale the day it was written, which meant shipping a framework carrying high-severity XSS advisories. CLAUDE.md now requires every version pin to be verified against the registry, and R11 requires re-checking at each build-order boundary. npm audit now reports 0 vulnerabilities, down from 16. Every Astro advisory is cleared; the residual 10 all traced to @lhci/cli, which is removed — it was the sole source of 7 high-severity findings, 0.15.1 is latest so there was no clean upgrade, and it cannot run without pages or a lighthouserc. Re-added at build step 7 with a freshly verified pin. Content collections migrated to the Content Layer API: src/content.config.ts, loader: glob(), z from astro/zod. Two review passes found seven defects in the fix itself, all now closed: - z.coerce.date() read an unquoted 20260801 as epoch milliseconds and yielded 1970-01-01 silently; the first replacement then accepted 2026-13-45 as an Invalid Date and rolled 2026-02-30 over to 2026-03-02. Dates are now anchored, date-only, parsed as UTC and round-tripped. - The title bound applied the SEO spec's 50-60 to the headline rather than the rendered <title>, which guaranteed 68-78 on every article and rejected all five planned launch headlines. Articles are now the documented exception: the headline is the <title>, no suffix. - An article could ship an image with no alt text, or whitespace-only alt. - Two schema comments asserted controls nothing enforced; both are now real refinements, each tested with a failing and a passing case. - PRACTICE_SLUGS and PRACTICE_AREAS could drift silently; a compile-time check now catches both directions. - eslint.config.js imported globals and @eslint/js undeclared, resolving by hoisting accident. - scripts/deploy-local.sh claimed parity with CI while skipping npm run check and two credential guards — on the only path this site can ship today. Accessibility linting is on (36 jsx-a11y rules) before step 1 writes the layout. An earlier claim in §7 that none was possible was wrong twice, and is corrected in AGENTS.md entry (t) along with the reasoning. Opens Q30 and Q31 for two unregistered claims in src/data/site.ts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF	2026-08-26 14:10:09 -04:00
Pouya LajevardiandClaude Opus 5	0d8b63380a	chore: install toolchain, wire lint, add local deploy path ... Answers four questions and starts build step 1. Q22 — the scoped deploy user does not exist: aws iam get-user returns NoSuchEntity. Recorded in §7 as NOT PROVISIONED and swept so that no file describes it as existing. §10 records that user/pouya, the broadly- permissioned personal user that has been authenticating to this account, must never be used in CI; scripts/deploy-local.sh refuses to run as it. Q23 — the Gitea instance reports 1.27.2, well above the vars-context floor, so the first-step guard is belt-and-braces rather than load-bearing. What remains is not a fact but a dependency: the instance is jointly administered, so enabling Actions and registering a runner both need a second admin. Hence npm run deploy (scripts/deploy-local.sh), which performs exactly what the workflow performs — same guard, same three passes, same headers, same invalidation. Documented as the current path, not as a workaround. §10 gains the risk that follows: the deploy secret will live on jointly administered infrastructure, where an instance admin can reach repo secrets. That does not change the plan, but it makes the scoped IAM policy the actual control between a shared Gitea instance and an AWS account holding another business's client-database backups. Never widen it. Q27 — response time is two business days, in site.ts with a derived short form so the confirmation email cannot drift from the page. Q28 — OBA sections confirmed, stamped "for now"; membership renews yearly, tracked as R10. Build step 1: dependencies installed and package-lock.json created, closing the npm ci blocker. ESLint flat config and Prettier config added; npm run lint, check and build all pass. Prettier deliberately excludes *.md and tokens.css — reasons recorded in .prettierignore. npm audit reports 7 high-severity advisories, all requiring an Astro major upgrade. Not applied; escalated in AGENTS.md entry (s) as a decision. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF	2026-08-26 11:54:04 -04:00
Pouya LajevardiandClaude Opus 5	6bf1167624	fix: sweep D3 amendment through the specs; correct inverted DKIM table ... The re-audit of the deploy-guard change surfaced defects well outside the diff, including one that would have broken production mail. docs/05-backend-spec.md had the two SES DKIM sets exactly inverted, labelling the three records that resolve as "orphans" and the three NXDOMAIN records as "Live. Never delete". Entry (j) corrected this in AGENTS.md §7 and the correction never reached docs/05. Since SES has no custom MAIL FROM, DKIM is the only thing satisfying DMARC, so acting on that table would have silently broken intake mail authentication. Also in this change: - .gitea/workflows/deploy.yml gains a guard as steps[0] that fails the run, naming the variable, if AWS_REGION, S3_BUCKET or CLOUDFRONT_DISTRIBUTION_ID is empty — how a Gitea too old for the vars context manifests. Verified fail-closed under bash -e, sh -e and bash -euo pipefail. - AGENTS.md Current Truth: SPF and DMARC recorded as present (Q20), the matching §10 High risk row retired, three duplicate Q rows removed. - docs/reference/AWS-Hosting-Guide.md tracked and given a do-not-execute banner; it was an executable procedure for the architecture D1/D3 replace. - Copy decks: "a working litigator" and "an active litigation practice" replaced with the register's own wording; LegalService JSON-LD replaced with ProfessionalService; tribunal-secretary offers removed per D14; nine stale question blockers swept. - astro.config.mjs: prefetchAll disabled — it injected JS into every page against the zero-JS convention with no decision recorded. - src/data/site.ts: unregistered response-time commitment nulled (Q27); OBA section names downgraded to [assumed] (Q28). - s3:AbortMultipartUpload reasoning corrected to measure ./dist, not the repo. Opens Q27, Q28, Q29. AGENTS.md entry (q) records the full resolution, including the findings declined and why. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF	2026-08-26 11:28:42 -04:00
Pouya Lajevardi	19f7226661	chore: project scaffold, specs, and working record	2026-08-26 08:51:16 -04:00