# Post-phase server audit — 2026-07-10

Generated from the canonical Markdown — do not hand-edit. Audit date 2026-07-10.

A read-only audit of the completed backend chain (backend-phase-0 → 15), produced after the final backend phase shipped. Three deliverables, each in canonical Markdown with a matching self-contained HTML view (`index.html` is the browsable entry point):

Deliverable | What it answers
--- | ---
post-phase-backend-plan.md · html | What backend work remains — 8 prioritized, runnable "post-phases" (security hygiene → money-path fixes → contract batch → scheduler/Redis → trust rails → money rails → observability → later)
frontend-backend-gaps.md · html | REQ-001…015 reconciled against the shipped contract + code: 2 done, 1 doc-fix, 12 missing; plus what unbuilt f9–f15 will hit, and the unblock priority
runtime-services.md · html | The deployment topology: 17 services/rails derived from the seams + config, a dependency graph, per-service defaults/config keys/health notes

Executive summary. The chain is genuinely complete against its own specs — 358 green tests, and the load-bearing invariants (balanced ledger groups, four money DB CHECKs, webhook idempotency, tenancy 404s, forward-only status machines) all verifiably exist in code. The API's only real external dependency today is SQL Server; all 18 vendor/infra seams are deterministic in-process mocks, which is the designed MVP posture. What the audit surfaced beyond that design: (1) committed live credentials — a real `sa` connection string in `appsettings*.json`, placeholder JWE/encryption keys, and a seeded `admin`/`qw123321` user — that block any deployment; (2) one genuine money-correctness hole — the BNPL/manual refund settlement path is unreachable (`Refund.MarkSucceededAsync` has zero callers), so those refunds strand `refund_payable`/`escrow_held` forever; (3) the frontend is still 11/12 domains mock-primary because 12 of its 15 filed REQs were never delivered and none were answered; (4) unattended operation doesn't exist yet — payout batches, credential-expiry scans, no-show sweeps, and Moadian reconciliation are admin-click-only while their cadence config keys sit unread; and (5) the promised forward-dep FKs (refunds→tickets, clawbacks→payouts, invoices→partner_centers) were never added after their target tables shipped. Full evidence and the fix-by-fix plan are in the three documents.