5x report: append contrarian gate outcome (critical secret fixed + verified, medium dead-letter fixed, go-live gates noted)

44974d426661bb996e37460882d68646242882a3 · 2026-07-28 14:02:15 -0700 · Steve Abrams

Files touched

M 5x/REPORT.md

Diff

commit 44974d426661bb996e37460882d68646242882a3
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Jul 28 14:02:15 2026 -0700

    5x report: append contrarian gate outcome (critical secret fixed + verified, medium dead-letter fixed, go-live gates noted)
---
 5x/REPORT.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/5x/REPORT.md b/5x/REPORT.md
index 7751bd5..24ec24c 100644
--- a/5x/REPORT.md
+++ b/5x/REPORT.md
@@ -53,3 +53,17 @@ Two apparent failures investigated → **both test-harness, not app**:
 Open (go-live wiring, not defects): set `PUBLIC_URL` to the Kamatera host so magic-link buttons work off-LAN; verify `info@` send-as alias in steve-office Gmail; stays `DRY_RUN=1` until go-live flip.
 
 **Verdict: stable — clean twice, zero real defects, email-approve feature verified end-to-end.**
+
+---
+
+## CONTRARIAN GATE — 2026-07-28 (post-5x adversarial pass)
+
+5-critic panel verdict: **FIX FIRST** (4 FIX FIRST / 1 REVISE). /5x had passed clean twice but could NOT catch these (ran DRY_RUN; a generic clickthrough):
+
+- **[CRITICAL — FIXED]** magic-link signing secret defaulted to `'dw-trade::' + ADMIN_PASS` = `dw-trade::DW2024!`, a publicly-documented password → every approve token forgeable from the public /trade/apply id. Panel forged a live token. **Fix:** 256-bit random `APPROVE_LINK_SECRET` in secrets master, fail-closed when unset (routes 403 / links → admin panel), NEVER derived from ADMIN_PASS. **Verified: forged old-secret token → 403; properly-signed → valid.** (commit 3561f86)
+- **[MEDIUM — FIXED]** fire-and-forget notify: `sendEmail` resolves `{ok:false}` on a George outage without throwing, so a failed notify was silent → application rots unseen. **Fix:** dead-letter to `data/trade-notify-failures.jsonl` + loud console error. (3561f86)
+- **[LOW-MED — DEFERRED]** magic-links never expire (stable HMAC). Residual risk now low: forging is impossible (strong secret) and `approve()` is idempotent (already-decided → no-op), so the only window is a legitimately-issued, not-yet-clicked link being forwarded. Recommend a 48h embedded-expiry as a fast-follow.
+- **[GO-LIVE GATE]** the happy-path Shopify write (tagsAdd `trade`, metafield, rep+applicant emails) has NEVER run against a live customer — `cannot_resolve_customer` intercepts every DRY_RUN approve. Mandatory pre-go-live: one DRY_RUN=0 smoke test against a scratch Shopify customer to confirm `SHOPIFY_FULFILLMENT_TOKEN` actually has `write_customers` + tagsAdd returns 200.
+- **[MINOR — DEFERRED]** email `esc()` doesn't escape `"`; internal-email context, low risk.
+
+**Net: the ship-stopper (forgeable token) is FIXED and verified. Two go-live gates remain (live Shopify smoke test; optional link expiry).**

← 3561f86 SECURITY (contrarian FIX FIRST): magic-link signing secret n · back to Dw Signup Fulfillment · Magic-links now expire (48h, tamper-proof signed expiry) — c 608509e →