feat/one-api

hasSite removed from mapper/schema but integration test still asserts it — will fail CI

apps/platform/src/__tests__/integration/utility-contracts-api.test.ts:319

hasSite was removed from UtilityContractListItemResponseSchema, the API type, and the mapper in this diff. The integration test at line 319 still asserts expect.objectContaining({ hasSite: true }). The API response no longer emits this field, so the assertion will fail. This file was not touched in the diff — the removal was incomplete.

Stale hasSite mock in cdc-harness.ts

apps/platform/src/lib/hooks/realtime/__tests__/cdc-harness.ts:364

makeOverviewContractsListResponse still sets hasSite: false in its mock objects. The return type is Array<Record<string, unknown>> so no compile error, but the field is now undefined contract surface. Harmless since no current consumer reads hasSite from this harness.

Documented product risk: RPU bonding without ownership verification (BAT-298)

domains/cross-domain/src/contract-wizard.shells.ts:1399

Any org knowing a 12-digit RPU can bond it via the wizard and read collected bills — no ownership-verification challenge. Explicitly acknowledged in the diff as a KNOWN OPENNESS on purpose. BAT-298 tracks this. No action needed, recorded for the security review record.

Service actors bypass RLS on public-v1 reads — documented deliberate posture

apps/platform/src/api/utils/public-v1-rls.ts:67

rlsDbFor returns bare service-role for 'service' actorType. Intentional — service credentials are platform-scoped. The rlsDbFor dispatch test pins this. Any future 'service'-scoped route that does a per-org read would silently cross org boundaries without an additional application-layer filter.

Rate-limit key prefers x-real-ip — security improvement noted

apps/platform/src/app/api/v1/[...ts-rest]/route.ts:1074

The change correctly prefers x-real-ip (platform-set, cannot be forged) over x-forwarded-for (client-appendable) for rate-limiting. This closes a trivial bypass on the scrypt endpoint. Positive change.

console.log in wizard handler error path leaks internal discriminators

apps/platform/src/api/handlers/utility-contracts.handler.ts:718

Line 718 `console.log('[Wizard] Shell returned error:', error._tag)` emits raw domain error tags to stdout. The canonical pattern uses createShellLogger for structured logging. Pre-existing but touched by this diff.

Wizard error mapper uses if-chain, not exhaustive switch on _tag

apps/platform/src/api/handlers/utility-contracts.handler.ts:718

The canonical form requires exhaustive switch on error._tag. The wizard handler uses sequential if (error._tag === '...') chains; the final arm falls through on statusCode. Pre-existing, but the diff removes two error types from the union without converting the if-chain.

utility-contracts-api.test.ts still asserts hasSite:true after field removal

apps/platform/src/__tests__/integration/utility-contracts-api.test.ts:319

Same as correctness finding — the hasSite field was removed from the wire contract but the integration test still expects it. This will cause a CI failure.

No RLS SELECT isolation test for utility_contracts after security hardening

apps/platform/src/__tests__/integration/rls-isolation.test.ts:285

The diff adds RLS tests for INSERT/UPDATE/DELETE on utility_contracts (closing 0077/0078 squat holes). However, there is no withRLS test verifying that org B cannot SELECT contracts belonging to org A (the contracts_select_member policy). A policy regression in contracts_select_member would not be caught at the raw RLS layer — only at the HTTP IDOR harness level.

rateLimitBucket x-real-ip preference in main v1 catch-all route has no test

apps/platform/src/app/api/v1/[...ts-rest]/route.ts:95

The security fix (prefer x-real-ip over x-forwarded-for) is tested for the OAuth standalone route but has no equivalent test for the main v1 catch-all route. The scrypt /auth/token endpoint passes through this route and the x-real-ip spoofing fix for it is untested.

isRlsRefusal dual-level message check has no unit test for the nested-driver case

domains/cross-domain/src/contract-wizard.shells.ts:118

The diff fixes isRlsRefusal to check both the drizzle wrapper message AND the driver's nested message. No unit test constructs the specific error shape ({ code: 'X', message: 'Failed query', cause: { code: '42501', message: 'row-level security policy violated' } }) to pin that the nested check fires. A regression that reverts to the old ?? pattern would pass integration tests if drizzle happens to propagate the phrase in that environment.

resolveContractAccess cross-org test uses service-role db — RLS not exercised

apps/platform/src/__tests__/integration/contract-access.test.ts:148

resolveContractAccess wraps its query in .transaction() for RLS. The integration test passes the raw service-role database connection (line 28: `const database = db as unknown as Database`). The cross-org isolation test relies entirely on the SQL WHERE clause — RLS is bypassed. A missing WHERE would pass the test but fail in production.

rls-isolation.test.ts missing DB skip guard — inconsistent with siblings

apps/platform/src/__tests__/integration/rls-isolation.test.ts:45

No describeDb/skipIf guard for POSTGRES_URL. Without it, running without a DB gives connection errors rather than clean SKIPPED. CI always has a DB but developer experience (local runs) is impacted. Sibling files (contract-access.test.ts, rls-machine-claim.test.ts) all have this guard.

Double-skip guard in api-telemetry-persistence can mask misconfigured-DB failures

apps/platform/src/__tests__/integration/api-telemetry-persistence.test.ts:95

Tests inside describeDb also guard with `if (!available) return;`. When DB is configured (POSTGRES_URL set) but unreachable, describeDb does NOT skip but !available causes every test to silently pass. A misconfigured-but-set DB will show all tests as PASSED. Pre-existing pattern extended to new blocks.

MCP tools/list smoke test upgraded to exact pin — adding a tool requires updating the count

packages/mcp-server/src/tools-list.smoke.test.ts:1752

Changed from toBeGreaterThanOrEqual(30) to toBe(30). This is an improvement that catches dropped tools. The sync checklist in .claude/rules/mcp-server.md should cross-reference this test file for discoverability.

Two structurally identical getAccessibleContracts helpers in bills.handler and csv/route

apps/platform/src/api/handlers/bills.handler.ts

After removing the entity_relationships branch from both, getAccessibleContracts in bills.handler.ts and csv/route.ts are now structurally identical (both call listContractPublicIdsByOrgId → findByPublicIds → findMonitoredContractIds). Extracting a shared helper would make the next change (RLS-wrapping these reads) a one-place change.

Migration files 0077 and 0079 missing trailing newlines

packages/database/drizzle/0077_tired_venus.sql

Both 0077_tired_venus.sql and 0079_deep_jean_grey.sql are missing the POSIX-required trailing newline (diff shows \\ No newline at end of file). Drizzle runner is unaffected, but this causes noisy git diffs and trips POSIX linters. Sibling 0080 ends with a newline.

mapWizardTxFailure passes empty string for missing contractNumber

domains/cross-domain/src/contract-wizard.shells.ts:192

The isUniqueViolation branch calls WizardErrors.contractExists(contractNumber ?? ''). The empty-string fallback is misleading: if the shell ever calls mapWizardTxFailure without a contractNumber, the error payload carries an empty RPU number which is invisible in logs. Either remove the ? (make it required) or use a sentinel like '<unknown>'.

isRlsRefusal and isUniqueViolation parallel pattern — shared pgHasErrorCode helper opportunity

domains/cross-domain/src/contract-wizard.shells.ts:114

Both functions independently check cause.code and cause.cause?.code in the same two-level drizzle-wrapper pattern. A single pgHasErrorCode(cause, code) helper would remove duplication. Very low priority.