Pouya LajevardiandClaude Opus 5
77a7b410b2
Pouya's rulings: Q44 (memberships current — ship the group), Q45 (PDF bio deferred to step 9), Q46(a) (three offerings pass all gates), Q46(b) (§11 ratified as the source for definitional expansions, conditional on committing the source), Q47 (set jobTitle and worksFor), the legal-advice formulation ratified without change, and Q22 closed on his own execution evidence. Q46(b): docs/reference/adrio-designations.md commits all five ADRIO expansions with reproducible sha256 (four fetches each; both review agents independently reproduced every digest). It immediately caught the error Pouya raised in the same message — §11 had said "Chartered Mediator-Arbitrator" since the file was created, ADRIO's term is "Chartered Med-Arbitrator", and the wrong form was in dist/about/index.html. Four prior review passes read that string and checked only whether it was sourced, not whether it was right. Q47 REVERTED after both review agents struck it independently. jobTitle shipped for one pass as "Mediator and Commercial Arbitrator" — the string claims-auditor had removed from this same node's description the previous day, since §4 has no row for a completed arbitration. The implementation flagged the wrong defect: it argued about scoping and missed that the whole string was already struck. worksFor was reverted because ProfessionalService.provider is this Person, so provider -> Person -> worksFor asserts a same-entity claim transitively. Now jobTitle: 'Mediator', no worksFor. Q49 asks for the two §4 rows. Q44: memberships render with NO currency warranty (his condition), and R10 is re-armed with an event trigger rather than a date since he declined renewal-date tracking. Q22: §7 goes to PROVISIONED; R17 carries the first rotation date, 2026-11-26. New CLAUDE.md convention, his: never suppress stderr in a verification script — suppression turns "it failed" into "it found nothing". Two review rounds resolved 48 findings; the majority of the second round were defects in the first round's fixes, including a re-widening of §4's renewal period inside the comment that corrects that widening, a cited guard in schema.ts that does not exist, and a struck §9 row describing a reverted state. Three findings were one lift from a public page: docs/03's /for-parties/ directive breached D13 twice, docs/01 told an implementer an unpublishable strip could ship, and docs/07 priced three ungated offerings with no gate note. Also commits docs/reference/adrio-extract/ — the extraction script and its five outputs, since the digests covered raw HTML and said nothing about the text the term counts were run against. The equivalent gap for Q22's IAM verification is NOT closed and is Q52. Verified: astro check 0/0/0, eslint + prettier clean, build 2 pages, 0 .js emitted, minifier guard silent, animation-timeline intact, no currency-warranty phrasing in dist, JSON-LD correct on both pages. NOT run: Lighthouse (tool unavailable until step 7, R11); HTML validator. Opens Q48-Q53. Live reminders: R1, R10, R11, R13, R14, R15, R16, R17. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0148NztQskLKKApP5SzAA78e
112 lines
5.5 KiB
Markdown
112 lines
5.5 KiB
Markdown
# adr.smlcompany.ca
|
|
|
|
The dispute resolution practice of Pouya Lajevardi — Toronto.
|
|
|
|
A static site built with [Astro](https://astro.build), built for deployment to
|
|
Amazon S3 behind CloudFront by Gitea Actions — see Deployment; the pipeline is
|
|
not yet proven.
|
|
|
|
## Quick start
|
|
|
|
```bash
|
|
nvm use # Node 22 LTS — the floor is in package.json engines
|
|
npm install
|
|
npm run dev # http://localhost:4321
|
|
```
|
|
|
|
## Scripts
|
|
|
|
| Command | Does |
|
|
|---|---|
|
|
| `npm run dev` | Development server with hot reload |
|
|
| `npm run build` | Static build to `./dist` |
|
|
| `npm run preview` | Serve the built site locally |
|
|
| `npm run check` | `astro check` — type and template errors |
|
|
| `npm run lint` | ESLint + Prettier check |
|
|
| `npm run format` | Prettier — rewrite files in place |
|
|
| `npm run deploy` | Build and deploy from this machine — see Deployment |
|
|
|
|
## Before you contribute
|
|
|
|
Read **`AGENTS.md`** first, and maintain it as you work — it is the living
|
|
record of what this project is, what was decided, and why. Then read
|
|
**`CLAUDE.md`** for the working rules, and the specs in `docs/`.
|
|
|
|
The single hardest rule: **no factual claim about Pouya, his credentials, his
|
|
experience, or his practice ships unless it appears in the verified register in
|
|
`AGENTS.md` §4.** This is a public marketing surface, and the site it replaces
|
|
contained fabricated credentials.
|
|
|
|
## How work is done here
|
|
|
|
Pouya decides; Claude Code implements and then adversarially reviews its own
|
|
work. Run **`/build <task>`** for any substantive change — it plans, implements,
|
|
runs two independent review agents on the diff (the claims audit wherever copy
|
|
changed), resolves the findings, verifies the build, and records the session in
|
|
`AGENTS.md`. `/review` runs the review pass alone; `/wrap` closes a session.
|
|
|
|
Full protocol and prompt guidance: `docs/08-execution-protocol.md`.
|
|
|
|
## Deployment
|
|
|
|
**Today, deploys run locally: `npm run deploy`** (`scripts/deploy-local.sh`).
|
|
It runs the same guard, the same three sync passes with the same cache headers,
|
|
and the same invalidation as the CI workflow — at this scale the pipeline
|
|
changes only *how* a deploy is triggered, not what it does. The script and
|
|
`.gitea/workflows/deploy.yml` are one artefact in two places: change one, change
|
|
both.
|
|
|
|
`.gitea/workflows/deploy.yml` is the CI pipeline — **Gitea Actions**, not GitHub
|
|
Actions. **It has never run**, for two reasons that are not oversights:
|
|
|
|
- Actions are not enabled and no runner is registered. The Gitea instance is
|
|
jointly administered, so both need its second administrator (Q23).
|
|
|
|
*(It previously listed a second reason — that the scoped IAM user did not exist.
|
|
**It exists**: `adr-sml-deploy`, created 2026-08-26, Q22 closed 2026-08-28. See
|
|
`AGENTS.md` §7 for the inventory and the least-privilege verification.)*
|
|
|
|
Its **first** step is a guard: the run aborts, naming what is missing, if any
|
|
required variable or either AWS secret is empty. Only emptiness is tested and no
|
|
value is echoed.
|
|
|
|
The GitHub Actions equivalent, which uses OIDC role assumption, is kept as
|
|
`docs/reference/github-actions-oidc.yml.example` in case the project ever moves
|
|
to a forge that supports it. It sits outside `.github/workflows/` on purpose:
|
|
Gitea falls back to that directory when `.gitea/workflows` is absent, so a
|
|
workflow file left there with a `push` trigger would be only conditionally
|
|
inert. As an `.example` under `docs/` it cannot be picked up at all.
|
|
|
|
**The pipeline is designed around a long-lived AWS credential, and that
|
|
credential now exists.** Gitea is not an AWS OIDC provider, so there is no role
|
|
to assume: deploys authenticate as a scoped IAM user, `adr-sml-deploy`, with its
|
|
access key in the repository's Gitea Actions secrets. **The user was created
|
|
2026-08-26 and verified least-privilege by execution — `AGENTS.md` §7, Q22 closed
|
|
2026-08-28.** Its access key has **never been used** (`LastUsed` null), because
|
|
deploys still run locally. *(This paragraph asserted the user "has not been
|
|
created" until 2026-08-28.)* In the meantime the local script
|
|
**refuses to run as `user/pouya`**, the broadly-permissioned personal user —
|
|
see `AGENTS.md` §10. Two things are meant to bound the risk, and neither is in
|
|
place yet:
|
|
|
|
- **The policy must stay narrow.** Four actions: `s3:ListBucket` on one bucket,
|
|
`s3:PutObject` and `s3:DeleteObject` on that bucket's contents, and
|
|
`cloudfront:CreateInvalidation` on one distribution. No `Action: "*"`, no
|
|
`Resource: "*"`, nothing outside that one bucket and that one distribution.
|
|
The AWS account is shared with unrelated projects, including a bucket whose
|
|
name indicates another business's production database backups — that
|
|
narrowness is what keeps a compromised runner away from it, and it is
|
|
load-bearing rather than hygiene. See `AGENTS.md` §10. If a deploy step needs
|
|
a permission the policy lacks, question the step; do not widen the policy.
|
|
- **The key must be rotated quarterly. It now has an owner and a date: first
|
|
rotation due 2026-11-26** (key created 2026-08-26) — `AGENTS.md` §12 **R17**.
|
|
Create a second access key, update the Gitea secrets, confirm a deploy
|
|
succeeds, **then** delete the old one — rotation that leaves the old key active
|
|
is not rotation, and deleting before verifying leaves no way to authenticate
|
|
the fix. OIDC would have removed the obligation entirely; it is unavailable, so
|
|
this is a standing calendar task. *(It read "nobody owns that yet" until
|
|
2026-08-28; R17 is the owner, and the date is the whole point of the row.)*
|
|
|
|
Full procedure, IAM policy, runner setup, and cutover checklist:
|
|
`docs/06-deployment.md`.
|