3 Commits

Include renames

Author	SHA1	Message	Date
Pouya LajevardiandClaude Opus 5	02739adac9	fix: refute (ar)'s intake finding; fix the D20 gloss class; add X-Robots-Tag on *.pdf ... Pouya's rulings of 2026-09-03, in five parts. 1. THE INTAKE FORM IS NOT BROKEN. (ar) was wrong. docs/09 §7.1 verbatim — POST /api/intake with an Origin header — returns 303 to /contact/could-not-send/ with access-control-allow-origin echoed; the same probe without Origin returns 403. A bare POST 403s BY DESIGN and §7.1 says so three lines below the probe it prescribes: "403 means the Origin header did not arrive". The earlier finding read a status code without reading the document that defines it. Second time in two days. CLAUDE.md's instrument list goes eight to nine. D20 findings 12 and 19 fall with it; §7.2 (that both emails arrive) is still owed. The correction is APPENDED as entry (as); (ar) stands unedited. 2. The privacy retention comment was stale, not a defect — superseded by his decision to publish and confirm after launch, reading from 2026-09-04. Reworded; the TODO(pouya) came off with the gate it enforced. The mechanism finding survives: it was a JSX comment, stripped by Astro, so no build or deploy path could see it. A publication gate that lives only in a stripped comment is not a gate. §9 Q60 corrected. 3. The gloss class is fixed — 15 of the 20 D20 findings, 14 distinct edits across 9 files, under the rule "the gloss may say no more than the extract says; no new claims, no new sources". Swept three unpublished insights drafts too, and corrected the wrong CAA attribution at its source in docs/reference/, which is where a fixed page re-seeds. /bio/ changed, so the committed PDF is regenerated (89,549 B, 1 page asserted). Three findings outstanding: 10 needs a ruling, 11 is ruled and owed via Q60, 13 needs him to have said it. R1 is not one of the twenty. 4. X-Robots-Tag cannot be done with S3 object metadata — --metadata writes user metadata, returned as x-amz-meta-x-robots-tag, which no crawler reads. Built as the CloudFront response-headers policy docs/06 has specified all along: configure.mjs section 4. It needs a --apply run, not a deploy. The policy is cloned from whatever is attached at run time and reconciled on every run, because a response-headers policy replaces rather than merges. 5. Headshot deferred as an open non-defect. The master and the srcset ladder are both fine; Astro passes no quality, so AVIF encodes at sharp's default 50 and is served first. Two review rounds, 29 findings, all resolved, none declined; stopped at two per D19. NINE of round 2's fourteen were defects in round 1's own repairs — including a fix that harmonised both /fees/ rows onto wording that was itself unregistered, publishing an unsourced fee term twice where it had been once. Gates, exit status read for each: check 0 (0 errors, 0 warnings, 0 hints), build 0 (23 pages), check:claims 0, check:intake 0, og:proof 0, lint 0, minifier grep exit 1, router.test.mjs 30/30. Lighthouse NOT run. Nothing deployed and nothing applied to the distribution. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5	2026-09-03 17:23:20 -04:00
Pouya LajevardiandClaude Opus 5	6aaf089b05	feat: rule Q62 by stating the truth; strike the /med-arb/ gloss; re-stamp R18 ... Pouya's four rulings of 2026-09-01, applied 2026-09-02. Q62 — RULED "state the truth", not "remove the access". /legal/privacy/ now says two people can read the intake table, names their role, and adds the two stronger facts the false sentence had crowded out: the handler role holds PutItem only, and adr-sml-deploy is implicitDeny on all seven read and write actions. Wording is subject to Pouya's read-through — Q63(a), with a TODO(pouya) beside the copy. The ruling named one sentence; a vocabulary sweep found the falsehood in three places, and the audit then found two more. Five paragraphs now answer "who can see it" and change together. The tripwire stays permanently, per ruling, and grew from two alternatives to five. Every alternative is one string that reached dist/. Proven both ways against the pre-correction page rebuilt from bd282aa: exit 1 with 5 matches at dist/legal/privacy/index.html:54,67,67,68,72; exit 0 on the corrected page, self-test 12 patterns / 36 approved strings. /med-arb/ — the gloss is struck with no replacement, per ruling. The strike left "the section above" pointing at the ADRIC rule set and "the agreement" with no antecedent; both fixed. The bare designations line sitting under ADRIC's quoted competence requirement is also struck, which goes beyond the ruling and is flagged for Pouya. R18 — re-stamped, two-tier: (a)(c)(d) re-verified against a source, (b)(e)(f)(g) held on a cadence judgement. All seven hold, no shipped sentence changed. R18's trigger had NO cutover checklist item and had stamped five extracts of seven; both fixed. Candidate limb (h) flagged. R10 — fired and unsatisfied; left open on instruction. The evidence behind the new privacy sentence was weaker than the sentence. Re-measured: 33 of 33 roles simulated (23 of 26 carried inline policies nobody had read; the two CDK lookup roles can read the table), four trust policies, the CloudFormation escalation path for all five users, 0 federated providers, root recorded. Every read path terminates at the same two people. Two review rounds, 36 findings. 35 fixed, 1 declined. Five of round 2's were defects in round 1's own fixes; stopped at two per D19. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5	2026-09-02 07:59:50 -04:00
Pouya LajevardiandClaude Opus 5	79b19a7bd0	feat: build step 5 — /practice/ and six area pages; check:claims gates §4 in dist ... Step 5 ships /practice/ and the six practice-area pages (construction, technology, energy, insurance, shareholder, cross-border) from one route, and adds the mechanical §4 gate Pouya ruled for. check:claims — §4 Forbidden becomes a build error scripts/check-claims.mjs greps dist/**/*.html for 10 patterns, each carrying the incident that put it there. It strips <style> and non-JSON-LD <script> first (a bare sweep for "leading" returned 26 hits, 25 of them var(--leading-body)), self-tests every pattern against fixtures before sweeping, and refuses a missing, empty or stale dist/. Wired into /build Phase 5 and both deploy paths. Q54 — six conduct undertakings publish, and §4 gains a third class Conduct undertakings sit apart from credentials and offerings: the gate is that Pouya said it in terms. The strings live in CONDUCT_UNDERTAKINGS so a softening is one visible diff. (e) and (f) replace the third-person sentences already on /arbitration/ rather than joining them. Q49, Q50 recorded as rulings. §7 records the SES us-east-1 stray identity's deletion. R11 holds typescript at its current major, with the peer-range reason recorded. Three facts corrected, two of them already shipped - The LAT gloss said mediation "before filing and continuing after filing"; the Tribunal names mediation for "Before you apply" only and its second sentence is about negotiation. An ellipsis in docs/01 had deleted it. - "Connection allocation" is not an Ontario term. - "The 2026 privacy statute" does not exist — Bill C-27 died without royal assent. Struck from docs/03 rather than corrected in place. ADR Chambers struck from /arbitration/ and from docs/01 item 3 (Pouya, 2026-08-30): the source establishes what the firm publishes, not that an outside neutral can be appointed under its rules. claims-auditor gains a second lens — for every quoted source, whether the sentence beneath stays inside what the quotation establishes. Four shipped defects had that shape and none of them is greppable. CLAUDE.md gains a convention: never truncate the output of a check you intend to believe. `npm run check | tail -3` returns warnings, hints and a blank line and drops the errors line; it was reported as passing four times while astro check was exiting 1 with 10 type errors. Gates, exit status read directly, not through a pipe: npm run check exit=0 npm run lint exit=0 npm run build exit=0 npm run check:claims exit=0 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5	2026-08-30 09:35:26 -04:00