D19 into §3 and swept to all six destinations Pouya named: both agent briefs
(scope + severity filter), /build Phases 2–4 (non-gating questions, scope, stop
signal, two-round cap), /wrap, and CLAUDE.md (comments record decisions, not
history). Sweep verified by command, not recalled.
Rulings applied:
Q46(a) PUBLISHABLE — three §4 Offerings rows flipped; gate 1 records
[Pouya's stated basis], never [verified]. Step 5 unblocked.
Q48 closed, not site-relevant.
Q49 one §4 row, "Mediator"; read as declining Q49(b), so worksFor stays out.
Q50 DEVIATES — ships as name + slogan, not the concatenation. Flagged.
Q51 OBA sections stay; the regulator/voluntary distinction recorded.
Q52 docs/reference/deploy-credential-verification.md — 18 read-only AWS
calls, re-run rather than transcribed, access key ID redacted.
Q53 memberOf emitted on /about/'s Person node.
Two review rounds. The headline finding was this session's own: the Q53 sweep
was asserted and never run, leaving six in-scope records saying memberOf was
withheld — including §12 R10, which is read aloud every session. Round 2 then
found that round 1's simplification had put memberOf on / as well; the per-page
opt-in is restored, because Pouya's ruling turns on /about/'s visible HTML.
Also fixed: MEMBERSHIP_ORGS had orphaned BOUTIQUE's D16 JSDoc; /'s title now
derives from the constants; §7's deploy row stated and retracted three facts.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0148NztQskLKKApP5SzAA78e
Separated from the step 1 feature commit on adversarial-reviewer's own
recommendation: instructions that narrow a reviewer's scope should not
travel in the same commit as the work that reviewer is checking.
claims-auditor.md — REMOVE the enumerated membership list. It read
"ADRIC, ADRIO, OBA sections only" while AGENTS.md §4 had gained the
Canadian Tax Foundation that morning, so the auditor's own brief
contradicted the register: it would have flagged a verified membership
as unverified and would not have noticed CTF being dropped. This file
has now hosted a stale claim twice. Replaced with an instruction to
read the §4 row at audit time — a copy of a fact goes stale where
nobody re-reads it.
adversarial-reviewer.md — state that Lighthouse cannot be run until
step 7 and that its absence is not a finding (AGENTS.md §7, R11).
Repair a sentence left truncated mid-list. Caveat the "~1 MB of logo
PNGs" figure against Q34, which is open on it.
build.md — Phase 4 now carries the measurement that justifies the
re-review requirement: on the Astro 5→7 upgrade four of six
second-round findings were defects in the first round's own fixes.
Phase 5 gains a grep asserting no `animation` shorthand beside
`animation-timeline` survives into dist — Lightning CSS folds them
into an invalid declaration that works in dev and is dead in the
build. That happened twice in one session, the second time inside the
fix for the first.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF
The re-audit of the deploy-guard change surfaced defects well outside the
diff, including one that would have broken production mail.
docs/05-backend-spec.md had the two SES DKIM sets exactly inverted, labelling
the three records that resolve as "orphans" and the three NXDOMAIN records as
"Live. Never delete". Entry (j) corrected this in AGENTS.md §7 and the
correction never reached docs/05. Since SES has no custom MAIL FROM, DKIM is
the only thing satisfying DMARC, so acting on that table would have silently
broken intake mail authentication.
Also in this change:
- .gitea/workflows/deploy.yml gains a guard as steps[0] that fails the run,
naming the variable, if AWS_REGION, S3_BUCKET or CLOUDFRONT_DISTRIBUTION_ID
is empty — how a Gitea too old for the vars context manifests. Verified
fail-closed under bash -e, sh -e and bash -euo pipefail.
- AGENTS.md Current Truth: SPF and DMARC recorded as present (Q20), the
matching §10 High risk row retired, three duplicate Q rows removed.
- docs/reference/AWS-Hosting-Guide.md tracked and given a do-not-execute
banner; it was an executable procedure for the architecture D1/D3 replace.
- Copy decks: "a working litigator" and "an active litigation practice"
replaced with the register's own wording; LegalService JSON-LD replaced with
ProfessionalService; tribunal-secretary offers removed per D14; nine stale
question blockers swept.
- astro.config.mjs: prefetchAll disabled — it injected JS into every page
against the zero-JS convention with no decision recorded.
- src/data/site.ts: unregistered response-time commitment nulled (Q27);
OBA section names downgraded to [assumed] (Q28).
- s3:AbortMultipartUpload reasoning corrected to measure ./dist, not the repo.
Opens Q27, Q28, Q29. AGENTS.md entry (q) records the full resolution,
including the findings declined and why.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF
