cycle 13 docs: YOLO_NOTES ledger — whatsapp + apple fetch bounds (last two unbounded live fetches)

a5c06b38f92ee6bcd19e6dab270bac10b16d6db1 · 2026-09-23 22:13:39 -0700 · Steve

Records the whatsapp Graph API + apple JWKS fetchT swaps (all 5 live provider
fetches now bounded), build.js verified clean, the gitleaks false-positive
handling, and the Cody-required route-level apple timeout test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TouFkmUGKHtwqpZwgReVic

Files touched

M YOLO_NOTES.md

Diff

commit a5c06b38f92ee6bcd19e6dab270bac10b16d6db1
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed Sep 23 22:13:39 2026 -0700

    cycle 13 docs: YOLO_NOTES ledger — whatsapp + apple fetch bounds (last two unbounded live fetches)
    
    Records the whatsapp Graph API + apple JWKS fetchT swaps (all 5 live provider
    fetches now bounded), build.js verified clean, the gitleaks false-positive
    handling, and the Cody-required route-level apple timeout test.
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01TouFkmUGKHtwqpZwgReVic
---
 YOLO_NOTES.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/YOLO_NOTES.md b/YOLO_NOTES.md
index 6a69397..c59a24d 100644
--- a/YOLO_NOTES.md
+++ b/YOLO_NOTES.md
@@ -314,3 +314,24 @@ Canonical apply order now: `004_marketplace → 005_apple → 006_contacts → 0
 **Cost:** $0 (local tests + one Cody pass — which caught that my marker fix silently unlatched the poll's rescue coverage).
 
 **Backlog:** approval-enforcement decision still on Steve's desk. Provider-honored idempotency key still live-only. Coverage sweep continues — `routes/build.js`, `lib/apple.js`, `lib/whatsapp.js` deeper edge cases remain; or a fresh Cody audit for a new issue class.
+
+## /yoloforever CYCLE 13 (2026-09-23, yf-costa) — the LAST two unbounded live fetches (whatsapp + apple)
+
+**Audited `lib/whatsapp.js`, `lib/apple.js`, `routes/build.js`.** Found the final two raw `fetch()` calls in the codebase (cycle 10 wrongly called plaid "the last one" — these two remained). Both are the unbounded-hang class, and both matter MORE than they look because **a hang is not an error**: callers wrap the calls in try/catch, but try/catch catches a throw, not a stalled fetch that never rejects.
+
+**Fix (both): swap `fetch` → the shared `fetchT`.** Now every live provider fetch in the repo (tilopay, onvo, plaid, whatsapp, apple — 5 total) is bounded.
+
+- **`lib/whatsapp.js` `_send`** (Meta Graph API): a hung send inside `confirmBooking` (best-effort notify) or the webhook auto-reply would stall the money-path caller (/pay, webhook, poll) forever. fetchT → catchable PROVIDER_TIMEOUT. **Cody: SHIP IT** — exhaustive grep found exactly 2 real call sites, both try/catch-wrapped best-effort; throw lands before any DB write; `markRead`/`sendTemplate`/etc. have zero callers. Noted (pre-existing, made LESS bad, follow-up ticket not blocker): the webhook auto-reply wraps the whole per-payload for-loop in one try/catch, so one slow send skips sibling events in a multi-message batch — bounded to one 15s window now vs. an unbounded hang before.
+- **`lib/apple.js` `jwks()`** (Apple Sign-in public keys): a hung JWKS fetch would hang POST /auth/apple forever. **Cody: clean, ship it** — one try/catch-wrapped caller; no DB write before verification resolves; the 1h `_keys` cache is assigned atomically only after fetchT AND res.json() resolve (a timeout leaves the old/empty cache — never a stale-but-trusted key or a verification bypass); keep the uniform 15s (tiny CDN-backed static doc fetched ~once/hour via cache, not per-login; shortening would risk false-401ing real logins on flaky mobile — the real UX lever is client-side).
+
+**`routes/build.js`: clean** — the one aggregate /status endpoint wraps every query in try/catch and the git call in execSync (bounded); no unbounded-fetch / uncaught-throw / fail-open pattern.
+
+**Cody-required (met, matching the plaid-routes precedent):** a route-level test proving the "no DB write before verification" claim mechanically, not by hand-trace — added `apple-route-timeout.test.js` (POST /auth/apple through the real verifier + stalled fetch → 401 + pool.query never called).
+
+**Also handled:** a gitleaks pre-commit false-positive on JWT-shaped test-token literals — rebuilt the fixtures from parts (`b64u({...})`) rather than `--no-verify` (never skip a hook without Steve's ok).
+
+**Tests (+6, suite 175 → 181):** whatsapp-timeout.test.js (3), apple-jwks-timeout.test.js (2), apple-route-timeout.test.js (1).
+
+**Cost:** $0 (local tests + two focused Cody passes).
+
+**Backlog:** ALL live provider fetches now bounded; provider-agnostic timeout hardening is fully complete across every integration. Remaining: approval-enforcement decision on Steve's desk; provider-honored idempotency key (live-only); the per-event webhook-auto-reply try/catch follow-up; live-only sig-encoding verification. Next cycle: a fresh Cody-driven codebase audit for a NEW issue class (the fetch-timeout + async-error + fail-closed classes are now saturated), or deeper money-invariant / SQL-correctness review.

← 1d3aefd costa-rica: bound Apple JWKS fetch with fetchT (Cody-cleared · back to Costa Rica · costa-rica: bound booking money amounts against int4 overflo faf2ab6 →