Post-phase server audit — 2026-07-10
Generated from the canonical Markdown — do not hand-edit. Audit date 2026-07-10.
A read-only audit of the completed backend chain (backend-phase-0 → 15), produced after the final backend phase shipped. Three deliverables, each in canonical Markdown with a matching self-contained HTML view (index.html is the browsable entry point):
| Deliverable | What it answers |
|---|---|
| post-phase-backend-plan.md · html | What backend work remains — 8 prioritized, runnable "post-phases" (security hygiene → money-path fixes → contract batch → scheduler/Redis → trust rails → money rails → observability → later) |
| frontend-backend-gaps.md · html | REQ-001…015 reconciled against the shipped contract + code: 2 done, 1 doc-fix, 12 missing; plus what unbuilt f9–f15 will hit, and the unblock priority |
| runtime-services.md · html | The deployment topology: 17 services/rails derived from the seams + config, a dependency graph, per-service defaults/config keys/health notes |
Executive summary. The chain is genuinely complete against its own specs — 358 green tests, and the load-bearing invariants (balanced ledger groups, four money DB CHECKs, webhook idempotency, tenancy 404s, forward-only status machines) all verifiably exist in code. The API's only real external dependency today is SQL Server; all 18 vendor/infra seams are deterministic in-process mocks, which is the designed MVP posture. What the audit surfaced beyond that design: (1) committed live credentials — a real sa connection string in appsettings*.json, placeholder JWE/encryption keys, and a seeded admin/qw123321 user — that block any deployment; (2) one genuine money-correctness hole — the BNPL/manual refund settlement path is unreachable (Refund.MarkSucceededAsync has zero callers), so those refunds strand refund_payable/escrow_held forever; (3) the frontend is still 11/12 domains mock-primary because 12 of its 15 filed REQs were never delivered and none were answered; (4) unattended operation doesn't exist yet — payout batches, credential-expiry scans, no-show sweeps, and Moadian reconciliation are admin-click-only while their cadence config keys sit unread; and (5) the promised forward-dep FKs (refunds→tickets, clawbacks→payouts, invoices→partner_centers) were never added after their target tables shipped. Full evidence and the fix-by-fix plan are in the three documents.