exp/core-dossiers

webhook-endpoint public-v1 contract missed — 'only 2 of 9 core entities' is wrong

.claude/skills/dossier/references/_index.md:29

webhook-endpoint has its own public-v1 contract (webhooks.contract.ts). At least 3 entities have public-API presence, not 2.

contexts.contract.ts:155 cited in _findings.md P5 — should be 156

.claude/skills/dossier/references/_findings.md:49

Off-by-one line citation for deleteContext RBAC docstring.

context.md §3 off-by-one citations + internal contradiction with §4

.claude/skills/dossier/references/entities/context.md:89

§3 cites 155/201/258; §4 cites 155/202/259 — contradictory on relationship lines.

§1 'Infra' column inconsistent across dossiers

.claude/skills/dossier/references/_template.md:16

Present in 5 dossiers, absent in 4, unmentioned in schema description.

Context write handlers enforce 'member' despite contract advertising 'admin or owner'

apps/platform/src/api/handlers/contexts.handler.ts:97

requireOrgAccess(..., 'member') at lines 97,227,303,376,489. Any org member can manipulate hierarchy graph via direct API.

Invitation plaintext token logged to console in non-production environments

apps/platform/src/api/handlers/invitations.handler.ts:184

256-bit invite token logged — live credential leak risk if staging uses real-org data.

Service-role RLS bypass for inviter profile enrichment is correctly scoped

apps/platform/src/api/handlers/invitations.handler.ts:334

Intentional and constrained. Documented accurately.

`dossier` skill absent from CLAUDE.md skills table

CLAUDE.md:61

Every other skill has a row. Quick fix before merge.

Seven dossier headers claim both 'pending' and 'verified' simultaneously

.claude/skills/dossier/references/entities/membership.md:8

Pass-1 artifact in 7 of 9 dossier headers.

SKILL.md inlines ui-patterns.md taxonomy — drift risk

.claude/skills/dossier/SKILL.md:36

Restates Tier 2 rule content inside Tier 4 skill.

Invitation dossier §1 omits '(shared?)' from Public column

.claude/skills/dossier/references/entities/invitation.md:18

Cosmetic inconsistency with template and other dossiers.

Non-redundancy contract correctly honoured across all 9 dossiers

No dossier restates backend facts. All correct.

Tier placement correct

Rule at Tier 2, skill at Tier 4. Correct.

Contexts integration test expects 403 for members — handler enforces 'member' (contradiction)

apps/platform/src/__tests__/integration/contexts-api.test.ts:142

Test asserts 403 for member-role context writes; handler calls requireOrgAccess(..., 'member'). Either CI is currently red or enforcement mechanism is undocumented.

No test asserts core.profile.created outbox event fires on signup

domains/core/src/profile/__tests__/profile-trigger.integration.test.ts

P1: auth.handler.ts:270,295 bypasses createProfileShell. No outbox assertion.

createMembershipShell has zero production callers and zero integration tests for canonical path

domains/core/src/membership/__tests__/membership.decisions.test.ts

P1: invitation.shells.ts:272-276 inserts membership directly. Canonical shell has no coverage.

PR is pure documentation — no new tests required

All 14 files under .claude/

No dossier freshness drift-check mechanism

.claude/rules/capability-dossier.md:67

PR correctly defers this; should be a named follow-up ticket.

Dossier consult step missing from /implement

.claude/skills/implement/SKILL.md

Highest-traffic entry point doesn't wire in the dossier consult step.

_findings.md has no lifecycle — no status column or ticket tracking

.claude/skills/dossier/references/_findings.md:1

P1-P6 will silently mislead once fixes land.

No enforcement signal for dossier refresh in /implement done checklist

.claude/skills/implement/SKILL.md

Mode C refresh not part of done-definition.

Mode A/B/C lacks an upfront decision tree

.claude/skills/dossier/SKILL.md:12

3-line decision tree would resolve the pick-mode ambiguity.

capability-dossier.md path scope misses domains/cross-domain

.claude/rules/capability-dossier.md:2

Coordinator shells (where parallel write paths live) won't trigger the rule.

_index.md 'Public twin?' definition duplicated

.claude/skills/dossier/references/_index.md:7

Definition appears twice in same file.

_findings.md P5 NEEDS-HUMAN has no escalation path

.claude/skills/dossier/references/_findings.md:44

No Linear ticket, owner, or guidance on NEEDS-HUMAN findings.