# Post-phase server audit — 2026-07-10

A read-only audit of the completed backend chain (backend-phase-0 → 15), produced after the final backend
phase shipped. Three deliverables, each in canonical Markdown with a matching self-contained HTML view
(`index.html` is the browsable entry point):

| Deliverable | What it answers |
| --- | --- |
| [post-phase-backend-plan.md](post-phase-backend-plan.md) · [html](post-phase-backend-plan.html) | What backend work remains — 8 prioritized, runnable "post-phases" (security hygiene → money-path fixes → contract batch → scheduler/Redis → trust rails → money rails → observability → later) |
| [frontend-backend-gaps.md](frontend-backend-gaps.md) · [html](frontend-backend-gaps.html) | REQ-001…015 reconciled against the shipped contract + code: 2 done, 1 doc-fix, 12 missing; plus what unbuilt f9–f15 will hit, and the unblock priority |
| [runtime-services.md](runtime-services.md) · [html](runtime-services.html) | The deployment topology: 17 services/rails derived from the seams + config, a dependency graph, per-service defaults/config keys/health notes |

**Executive summary.** The chain is genuinely complete against its own specs — 358 green tests, and the
load-bearing invariants (balanced ledger groups, four money DB CHECKs, webhook idempotency, tenancy 404s,
forward-only status machines) all verifiably exist in code. The API's only real external dependency today
is SQL Server; all 18 vendor/infra seams are deterministic in-process mocks, which is the designed MVP
posture. What the audit surfaced beyond that design: **(1)** committed live credentials — a real `sa`
connection string in `appsettings*.json`, placeholder JWE/encryption keys, and a seeded `admin`/`qw123321`
user — that block any deployment; **(2)** one genuine money-correctness hole — the BNPL/manual refund
settlement path is unreachable (`Refund.MarkSucceededAsync` has zero callers), so those refunds strand
`refund_payable`/`escrow_held` forever; **(3)** the frontend is still 11/12 domains mock-primary because 12
of its 15 filed REQs were never delivered and none were answered; **(4)** unattended operation doesn't
exist yet — payout batches, credential-expiry scans, no-show sweeps, and Moadian reconciliation are
admin-click-only while their cadence config keys sit unread; and **(5)** the promised forward-dep FKs
(refunds→tickets, clawbacks→payouts, invoices→partner_centers) were never added after their target tables
shipped. Full evidence and the fix-by-fix plan are in the three documents.