hamid
80 lines
6.7 KiB
HTML
80 lines
6.7 KiB
HTML
<!doctype html>
|
||
<html lang="en">
|
||
<head>
|
||
<meta charset="utf-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||
<title>Post-phase server audit — 2026-07-10</title>
|
||
<style>
|
||
:root{
|
||
--bg:#faf9f6; --fg:#26221c; --muted:#6d675e; --panel:#ffffff; --border:#ddd7cc;
|
||
--accent:#0e7a63; --accent-soft:#e4f2ee; --code-bg:#f1ede5; --th-bg:#efeadf;
|
||
--warn:#a04b12; color-scheme: light dark;
|
||
}
|
||
@media (prefers-color-scheme: dark){
|
||
:root{
|
||
--bg:#191714; --fg:#e8e3da; --muted:#a29a8d; --panel:#211e1a; --border:#3a352d;
|
||
--accent:#4fc3a8; --accent-soft:#1e3630; --code-bg:#2a261f; --th-bg:#2d2921;
|
||
--warn:#e09355;
|
||
}
|
||
}
|
||
*{box-sizing:border-box}
|
||
body{margin:0;background:var(--bg);color:var(--fg);
|
||
font:16px/1.62 ui-sans-serif,system-ui,"Segoe UI",Roboto,"Vazirmatn",sans-serif;}
|
||
main{max-width:72rem;margin:0 auto;padding:2.5rem 1.5rem 5rem;}
|
||
h1{font-size:1.75rem;line-height:1.25;margin:.2rem 0 1rem;}
|
||
h2{font-size:1.35rem;margin:2.4rem 0 .7rem;padding-top:1rem;border-top:1px solid var(--border);}
|
||
h3{font-size:1.08rem;margin:1.8rem 0 .5rem;color:var(--accent);}
|
||
p{margin:.6rem 0;}
|
||
a{color:var(--accent);text-decoration:none;} a:hover{text-decoration:underline;}
|
||
code{background:var(--code-bg);border-radius:4px;padding:.1em .35em;
|
||
font:.86em ui-monospace,"Cascadia Code",Consolas,monospace;overflow-wrap:anywhere;}
|
||
pre{background:var(--code-bg);border:1px solid var(--border);border-radius:8px;
|
||
padding: .9rem 1rem;overflow-x:auto;}
|
||
pre code{background:none;padding:0;}
|
||
hr{border:none;border-top:1px solid var(--border);margin:2rem 0;}
|
||
.tblwrap{overflow-x:auto;margin:1rem 0;border:1px solid var(--border);border-radius:8px;}
|
||
table{border-collapse:collapse;width:100%;font-size:.92rem;}
|
||
th{background:var(--th-bg);text-align:start;position:sticky;top:0;}
|
||
th,td{border-bottom:1px solid var(--border);padding:.5rem .7rem;vertical-align:top;}
|
||
td:not(:last-child),th:not(:last-child){border-inline-end:1px solid var(--border);}
|
||
tbody tr:last-child td{border-bottom:none;}
|
||
ul,ol{margin:.6rem 0;padding-inline-start:1.5rem;}
|
||
li{margin:.35rem 0;}
|
||
li>code:first-child{font-weight:600;}
|
||
nav.toc{background:var(--panel);border:1px solid var(--border);border-radius:10px;
|
||
padding:1rem 1.3rem;margin:1.4rem 0 2rem;font-size:.92rem;}
|
||
nav.toc strong{display:block;margin-bottom:.4rem;}
|
||
nav.toc ul{margin:.2rem 0;padding-inline-start:1.1rem;list-style:none;}
|
||
nav.toc>ul{padding-inline-start:0;}
|
||
nav.toc li{margin:.2rem 0;}
|
||
nav.toc .l3{padding-inline-start:1.1rem;font-size:.88em;color:var(--muted);}
|
||
nav.toc .l3 a{color:var(--muted);}
|
||
.crumbs{font-size:.85rem;color:var(--muted);margin-bottom:.3rem;}
|
||
.crumbs a{color:var(--muted);}
|
||
.stamp{font-size:.85rem;color:var(--muted);margin:-.4rem 0 1rem;}
|
||
figure.diagram{margin:1.5rem 0;padding:1rem;background:var(--panel);
|
||
border:1px solid var(--border);border-radius:10px;overflow-x:auto;}
|
||
figure.diagram svg{display:block;min-width:900px;width:100%;height:auto;}
|
||
details.src{margin:.6rem 0 1.6rem;font-size:.85rem;color:var(--muted);}
|
||
details.src summary{cursor:pointer;}
|
||
svg text{fill:var(--fg);font:13px ui-sans-serif,system-ui,"Segoe UI",sans-serif;}
|
||
svg .t2{font-size:11px;fill:var(--muted);}
|
||
svg .grp-title{font-size:12px;font-weight:600;fill:var(--muted);letter-spacing:.04em;}
|
||
svg .box{fill:var(--panel);stroke:var(--fg);stroke-opacity:.55;rx:8;}
|
||
svg .box.live{stroke:var(--accent);stroke-opacity:1;stroke-width:1.6;}
|
||
svg .box.mock{stroke-dasharray:5 4;}
|
||
svg .grp{fill:none;stroke:var(--border);stroke-width:1.2;rx:12;}
|
||
svg .edge{fill:none;stroke-width:1.7;}
|
||
svg .edge.real{stroke:var(--accent);}
|
||
svg .edge.mock{stroke:var(--muted);stroke-dasharray:6 4;}
|
||
svg .lbl{font-size:10.5px;fill:var(--muted);}
|
||
svg .arr-real{fill:var(--accent);} svg .arr-mock{fill:var(--muted);}
|
||
</style>
|
||
</head>
|
||
<body><main>
|
||
|
||
<h1 id="post-phase-server-audit-2026-07-10">Post-phase server audit — 2026-07-10</h1><p class="stamp">Generated from the canonical Markdown — do not hand-edit. Audit date 2026-07-10.</p>
|
||
<p>A read-only audit of the completed backend chain (backend-phase-0 → 15), produced after the final backend phase shipped. Three deliverables, each in canonical Markdown with a matching self-contained HTML view (<code>index.html</code> is the browsable entry point):</p>
|
||
<div class="tblwrap"><table><thead><tr><th>Deliverable</th><th>What it answers</th></tr></thead><tbody><tr><td><a href="post-phase-backend-plan.html">post-phase-backend-plan.md</a> · <a href="post-phase-backend-plan.html">html</a></td><td>What backend work remains — 8 prioritized, runnable "post-phases" (security hygiene → money-path fixes → contract batch → scheduler/Redis → trust rails → money rails → observability → later)</td></tr><tr><td><a href="frontend-backend-gaps.html">frontend-backend-gaps.md</a> · <a href="frontend-backend-gaps.html">html</a></td><td>REQ-001…015 reconciled against the shipped contract + code: 2 done, 1 doc-fix, 12 missing; plus what unbuilt f9–f15 will hit, and the unblock priority</td></tr><tr><td><a href="runtime-services.html">runtime-services.md</a> · <a href="runtime-services.html">html</a></td><td>The deployment topology: 17 services/rails derived from the seams + config, a dependency graph, per-service defaults/config keys/health notes</td></tr></tbody></table></div>
|
||
<p><strong>Executive summary.</strong> The chain is genuinely complete against its own specs — 358 green tests, and the load-bearing invariants (balanced ledger groups, four money DB CHECKs, webhook idempotency, tenancy 404s, forward-only status machines) all verifiably exist in code. The API's only real external dependency today is SQL Server; all 18 vendor/infra seams are deterministic in-process mocks, which is the designed MVP posture. What the audit surfaced beyond that design: <strong>(1)</strong> committed live credentials — a real <code>sa</code> connection string in <code>appsettings*.json</code>, placeholder JWE/encryption keys, and a seeded <code>admin</code>/<code>qw123321</code> user — that block any deployment; <strong>(2)</strong> one genuine money-correctness hole — the BNPL/manual refund settlement path is unreachable (<code>Refund.MarkSucceededAsync</code> has zero callers), so those refunds strand <code>refund_payable</code>/<code>escrow_held</code> forever; <strong>(3)</strong> the frontend is still 11/12 domains mock-primary because 12 of its 15 filed REQs were never delivered and none were answered; <strong>(4)</strong> unattended operation doesn't exist yet — payout batches, credential-expiry scans, no-show sweeps, and Moadian reconciliation are admin-click-only while their cadence config keys sit unread; and <strong>(5)</strong> the promised forward-dep FKs (refunds→tickets, clawbacks→payouts, invoices→partner_centers) were never added after their target tables shipped. Full evidence and the fix-by-fix plan are in the three documents.</p>
|
||
</main></body></html> |