Verify TK-11415 triage and resolve stale approval blocker

02a570da6a402e47cd49e7690debbf8e7a9e4e14 · 2026-09-10 20:19:59 -0700 · Steve Abrams
Files touched

A verification/TK-11415/verify.mjs
Diff

commit 02a570da6a402e47cd49e7690debbf8e7a9e4e14
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 10 20:19:59 2026 -0700

    Verify TK-11415 triage and resolve stale approval blocker
---
 verification/TK-11415/verify.mjs | 55 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/verification/TK-11415/verify.mjs b/verification/TK-11415/verify.mjs
new file mode 100644
index 0000000..34121ac
--- /dev/null
+++ b/verification/TK-11415/verify.mjs
@@ -0,0 +1,55 @@
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+const root = '/Users/macstudio3/Projects';
+const project = `${root}/dw-unbuyable-recovery-pilot`;
+const git = (dir, ...args) => execFileSync('git', ['-C', dir, ...args], {encoding:'utf8'}).trim();
+const source = fs.readFileSync(`${root}/hollywood-import/momentum-feed/refresh.mjs`, 'utf8');
+const key = source.match(/\b[a-f0-9]{64}\b/g)?.find(k => crypto.createHash('sha256').update(k).digest('hex').startsWith('66fd704dc09f'));
+if (!key) throw new Error('Expected public key fingerprint absent');
+const host = 'https://ms-e886719d86e7-4256.sfo.meilisearch.io';
+const assertions = [];
+function check(name, ok, evidence) {
+  assertions.push({name, verdict:ok ? 'PASS' : 'FAIL', evidence});
+}
+const url = 'https://momentumco.com/build/assets/app-DOnLSWOi.js';
+const bundleResponse = await fetch(url, {signal:AbortSignal.timeout(30000)});
+const bundle = await bundleResponse.text();
+check('Anonymous vendor bundle publishes identical key', bundleResponse.ok && bundle.includes(key) && bundle.includes(host.slice(8)), {url,http:bundleResponse.status,sha256:crypto.createHash('sha256').update(bundle).digest('hex')});
+for (const [name, path, bearer, method] of [
+ ['public-key search', '/indexes/redesign-colors/search', key, 'POST'],
+ ['invalid-key search', '/indexes/redesign-colors/search', 'invalid-tk11415-negative-control', 'POST'],
+ ['key-management denial', '/keys', key, 'GET']
+]) {
+ const response = await fetch(host + path, {method,headers:{Authorization:`Bearer ${bearer}`,'Content-Type':'application/json'},...(method==='POST' ? {body:JSON.stringify({q:'',limit:1})} : {}),signal:AbortSignal.timeout(30000)});
+ const body = await response.json();
+ const ok = name==='public-key search' ? response.ok && Array.isArray(body.hits) && body.hits.length===1 : [401,403].includes(response.status);
+ check(name, ok, {http:response.status,...(name==='public-key search' ? {hits:body.hits?.length} : {code:body.code})});
+}
+const queue = '/Users/macstudio3/.claude/yolo-queue/pending-approval';
+const memo = '2026-09-02-TK11133-meilisearch-key-rotation-routing.md';
+const decisions = fs.readFileSync(`${queue}/_decisions.jsonl`,'utf8').trim().split('\n').map(x=>JSON.parse(x));
+const decision = decisions.filter(x=>x.memo===memo).at(-1);
+check('Memo resolved with canonical decision provenance', decision?.decision==='FILE' && decision?.dest==='_resolved' && fs.existsSync(`${queue}/_resolved/${memo}`) && !fs.existsSync(`${queue}/${memo}`), decision);
+const commits = {'tk-11331-exec':'497b463','hollywood-import':'8d08f31','hollywood-price-2026':'bc898f7'};
+for (const [repo, commit] of Object.entries(commits)) {
+ const dir = `${root}/${repo}`;
+ check(`${repo} has no configured remotes`,git(dir,'remote')==='',{head:git(dir,'rev-parse','HEAD')});
+ const files=git(dir,'show','--pretty=format:','--name-only',commit).split('\n').filter(Boolean);
+ check(`${repo} annotation commit exists`,files.length===2,{commit,files});
+ for (const file of files) {
+  const content=fs.readFileSync(`${dir}/${file}`,'utf8');
+  check(`${repo}/${file} public classification`,content.includes('vendor-owned PUBLIC search key'),{file});
+  if (file.endsWith('.mjs')) execFileSync('node',['--check',`${dir}/${file}`]);
+  else execFileSync('python3',['-c','import sys; p=sys.argv[1]; compile(open(p).read(), p, "exec")',`${dir}/${file}`]);
+  check(`${repo}/${file} syntax`,true,{compiler:file.endsWith('.mjs')?'node --check':'Python in-memory compile'});
+ }
+}
+const snapDir=`${root}/hollywood-import`;
+check('Authenticated snapshot remains contained',git(snapDir,'ls-files','--','products-authed.html')==='' && git(snapDir,'log','--all','--format=%h','--','products-authed.html')==='' && !!git(snapDir,'check-ignore','products-authed.html'),{tracked:false,pathHistory:false,ignored:true,contentsRead:false,credentialsExercised:false});
+const test=execFileSync('node',['--test','--test-reporter=tap',`${project}/tk11040-momentum-reconcile/meilisearch-client.test.mjs`],{encoding:'utf8'});
+check('Existing client happy/auth/schema suite',test.includes('# pass 3') && test.includes('# fail 0'),{pass:3,fail:0});
+const proof={ticket:'TK-11415-tk-11133-residual-meilisearch-credential',timestamp:new Date().toISOString(),intent:'Verify public vendor configuration classification, existing containment and resolved approval; reconcile stale ticket blocker',risk_tier:'R3 read-only external verification; R0 evidence artifact',environment:'macstudio3; public Momentum bundle and vendor search API',build_identity:git(project,'rev-parse','HEAD'),key_digest:{last4:key.slice(-4),sha256_prefix:crypto.createHash('sha256').update(key).digest('hex').slice(0,12)},commands:['node /tmp/tk11415-verify.mjs','git show / remote / ls-files / check-ignore / log','node --check (3 files)','Python in-memory compile (3 files)','node --test meilisearch-client.test.mjs'],assertions,limitations:['GET /keys denial does not prove absence of every write permission; no write probes were attempted.','No configured remotes establishes current configuration, not historical absence of pushes.','Snapshot containment is checked by file tracking, ignore, and path history; no new whole-disk scan was run.'],cleanup:'No vendor state changes, credential rotation, deletion, routing, publish, or push. Only redacted local evidence retained.',rollback:'Evidence is additive; no operational rollback required.',verdict:assertions.every(x=>x.verdict==='PASS')?'PASS':'FAIL'};
+fs.writeFileSync('/tmp/tk11415-e2e-proof.json',JSON.stringify(proof,null,2)+'\n');
+console.log(JSON.stringify(proof,null,2));
+process.exitCode=proof.verdict==='PASS'?0:1;
← f0fd04b auto-data-snapshot: 2026-09-10T18:07:04 (4 data files) — ver · back to Dw Unbuyable Recovery Pilot · TK-11041: merge the Whistler/closeout paragraph into the ven 02a2486 →