hamid
2.5 KiB
Post-phase server audit — 2026-07-10
A read-only audit of the completed backend chain (backend-phase-0 → 15), produced after the final backend
phase shipped. Three deliverables, each in canonical Markdown with a matching self-contained HTML view
(index.html is the browsable entry point):
| Deliverable | What it answers |
|---|---|
| post-phase-backend-plan.md · html | What backend work remains — 8 prioritized, runnable "post-phases" (security hygiene → money-path fixes → contract batch → scheduler/Redis → trust rails → money rails → observability → later) |
| frontend-backend-gaps.md · html | REQ-001…015 reconciled against the shipped contract + code: 2 done, 1 doc-fix, 12 missing; plus what unbuilt f9–f15 will hit, and the unblock priority |
| runtime-services.md · html | The deployment topology: 17 services/rails derived from the seams + config, a dependency graph, per-service defaults/config keys/health notes |
Executive summary. The chain is genuinely complete against its own specs — 358 green tests, and the
load-bearing invariants (balanced ledger groups, four money DB CHECKs, webhook idempotency, tenancy 404s,
forward-only status machines) all verifiably exist in code. The API's only real external dependency today
is SQL Server; all 18 vendor/infra seams are deterministic in-process mocks, which is the designed MVP
posture. What the audit surfaced beyond that design: (1) committed live credentials — a real sa
connection string in appsettings*.json, placeholder JWE/encryption keys, and a seeded admin/qw123321
user — that block any deployment; (2) one genuine money-correctness hole — the BNPL/manual refund
settlement path is unreachable (Refund.MarkSucceededAsync has zero callers), so those refunds strand
refund_payable/escrow_held forever; (3) the frontend is still 11/12 domains mock-primary because 12
of its 15 filed REQs were never delivered and none were answered; (4) unattended operation doesn't
exist yet — payout batches, credential-expiry scans, no-show sweeps, and Moadian reconciliation are
admin-click-only while their cadence config keys sit unread; and (5) the promised forward-dep FKs
(refunds→tickets, clawbacks→payouts, invoices→partner_centers) were never added after their target tables
shipped. Full evidence and the fix-by-fix plan are in the three documents.