docs(audit): close Phase A — A→B→C data flow + reclassifications - #59
Merged
Conversation
Phase A (audit dimensions) is now walked end-to-end. This PR adds: §9b — Dead-entitlement removals (records the #57 deletion of soc2_certification + executive_rollup; closes audit row #14). §9c — A→B→C data flow findings (4 verified rows: HIGH role-change surface gap, HIGH trial-state stale Zustand, MED org-name client cache, MED revokeInvitation org-id input-trust gap). Plus 12 rejected-with-reason rows from the data-flow agent pass that did not survive direct inspection (force-dynamic at /app/* layout killed most of the "stale SSR cache" claims; the Stripe webhook already calls revalidatePath; the email-mismatch invite-accept scenario is explicitly guarded; "if a user is added to multiple orgs in the future" is speculative not actual). Also reclassifies: #19 (onboarding framework provisioning race) HIGH → MED. The proposed audit fix doesn't actually close the race; the real fix is a "provisioning in progress" state on /app/compliance/ frameworks/[slug], which is a different surface from onboarding. #9 (v1 error-shape consistency) — added "scope larger than first cited" note since the grep found 12 files, all flattened in #58. PR refs added to rows #9 and #14. The audit now records 36 verified findings; the open HIGH set is #19 (reclassified MED), #33 (no role-change action), #34 (trial state stale in Zustand). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Pull request overview
Closes out “Phase A” of the audit documentation by adding end-to-end A→B→C multi-tenant data-flow walk findings, recording dead-entitlement removals, and updating prior findings with shipped PR references / reclassifications.
Changes:
- Add §9b documenting removal of dead entitlements (
soc2_certification,executive_rollup) and link to PR #57. - Add §9c capturing verified A→B→C data-flow findings (#33–#36) plus a rejected-findings trail for transparency.
- Update existing audit rows with reclassification (#19) and a scope note + PR reference for v1 error-shape flattening (#58).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+288
to
+290
| audit currently records 36 verified findings (3 HIGH still open: #19 | ||
| [reclassified], #33, #34 — plus 13 MED and a tail of LOW). PR refs | ||
| for shipped fixes: #50, #52, #57, #58. |
♿ Accessibility Test Results✅ PASSED - No critical accessibility issues found Tests Performed:
Artifacts: Download the accessibility reports from the "Artifacts" section for detailed results. |
4 tasks
ejay-dev
added a commit
that referenced
this pull request
May 14, 2026
Three audit-LOW items closed; each is a tight scoped fix. #17 — Drop deprecated X-XSS-Protection header ----------------------------------------------- Modern browsers ignore `X-XSS-Protection: 1; mode=block` (Chrome dropped the auditor in M78, Firefox never honoured it). Dead weight in next.config.ts headers. Replaced with a comment that documents the why and names CSP + Trusted Types as the current XSS defense so a future reviewer doesn't put it back. #62 — Surface founding year on /about -------------------------------------- JSON-LD claimed `foundingDate: "2025"` but no visible page text matched. Hero badge expanded from "About FormaOS" to "About FormaOS · Founded 2025 · Sydney, Australia" — single visible surface, matches JSON-LD foundingDate AND `address.locality`, no new component. #59 — Blog dateModified ----------------------- Evergreen regulatory content needs "last reviewed" visibility, not just first-published date. Added optional `dateModified?: string` to the BlogPost type (defaults to publish date when not revised), threaded through to articleSchema's new `dateModified` JSON-LD field, and surfaced a visible "Updated <date>" line on /blog/[slug] only when the modified date differs from publish date. Existing posts opt in by setting `dateModified` on their data row; no current post is forced to change. Audit-doc rows #17, #59, #62 annotated with shipped status. Co-authored-by: ejaz <ejaz@local> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase A (audit dimensions) is now walked end-to-end. This PR closes
the loop on the master prompt's six critical flows and records the
reclassifications that came out of second-pass verification.
Additions
soc2_certification+executive_rollup. Closes audit row fix(blocker-7): mobile scope decision proposal #14.org_members.roleis written exactly once during onboarding for the owner's own row; noupdateMemberRoleaction exists.useTrialStatereads from Zustand only. Code comment explicitly states "Never triggers additional server calls — pure derived state." Trial expires server-side butFeatureGate.isFeatureLocked()keeps lying until a full page reload.updateOrgNamerevalidates SSR paths but doesn't invalidateuseAppStore.organization.name. Client components reading the name from the store show stale value until reload.revokeInvitationtrustsorganizationIdfrom FormData. RLS protects at the DB layer but the server action should validatepermissionCtx.orgId === organizationIdbefore issuing the UPDATE.force-dynamiclying-cache claims that don't apply because/app/*is force-dynamic at the layout level, or speculative future-state claims).Reclassifications
/app/compliance/frameworks/[slug], which is a different surface.PR refs added
Phase A state
The audit now records 36 verified findings. Open HIGH set: #19 (reclassified MED), #33 (no role-change action), #34 (trial state stale in Zustand).
Test plan
mainHEAD.🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.7 noreply@anthropic.com