feat/one-api

contract-access.test.ts tests 142-187 lack `if (!available) return;` guards

apps/platform/src/__tests__/integration/contract-access.test.ts:142

If beforeAll partially fails (seedTwoOrgsWithUsers() succeeds but mkContract() throws), available stays false and sitedContractPublicId/foreignContractPublicId/orgAId remain undefined. The 5 tests at lines 142, 147, 152, 169, 180 have no `if (!available) return;` guard — they execute against undefined variables. Vitest does not fail-fast on a failing peer test, so the 'fixture built' sentinel does not protect them. Contrast with rls-machine-claim.test.ts which has the guard in every test. Fix: add `if (!available) return;` to each test, or use beforeEach to assert availability.

KNOWN_UNUSED ratchet scan counts test-file references as production callers

apps/platform/src/api/contracts/__tests__/declared-status.guard.test.ts:175

The workspace walk includes __tests__ directories. A code referenced only in a test assertion (e.g. expect(error._tag).toBe('ENTITY_NOT_FOUND')) satisfies the 'has a caller' check and removes it from KNOWN_UNUSED, masking that the code has no production caller. If the intent is to detect codes with no production callers, __tests__ dirs should be excluded from the blob construction. Currently the 6 KNOWN_UNUSED codes may be dead in both production and tests — a test-only reference would silently shrink the list.

x-real-ip fix not applied to main v1 ts-rest rate limiter

apps/platform/src/app/api/v1/[...ts-rest]/route.ts:91

The x-real-ip priority fix (prefer platform-injected header over client-appendable x-forwarded-for) was applied only to the OAuth token standalone route. The main ts-rest mount's rateLimitBucket function still keys anonymous requests on x-forwarded-for's first hop only. An unauthenticated attacker can rotate rate-limit buckets by appending fake IPs to x-forwarded-for. Authenticated requests (keyed on Bearer token hash) are unaffected. The fix pattern is in route.ts lines 87-90.

auth.handler.ts getClientIP has inverted x-real-ip / x-forwarded-for priority

apps/platform/src/api/handlers/auth.handler.ts:374

The getClientIP helper for /auth/forgot-password and /auth/reset-password rate limiters checks x-forwarded-for first, then x-real-ip — the inverse of the correct Vercel priority. A client can spoof x-forwarded-for to bypass per-IP rate limits on password-recovery endpoints. Pre-existing bug not introduced here, but round-3 fixed the OAuth route without porting the fix to auth.handler.ts.

ALTER DEFAULT PRIVILEGES without FOR ROLE clause: scope limited to migration runner

packages/database/drizzle/0076_anon_lockdown.sql:21

ALTER DEFAULT PRIVILEGES without FOR ROLE only revokes future auto-grants for tables created by the current migration runner role. If a future table is created by a different Postgres role, it would still auto-grant ALL to anon. Low severity because Supabase migrations consistently run as postgres superuser, matching the existing 0072 pattern.

lead_submissions anon INSERT: no DB-layer content validation

packages/database/drizzle/0076_anon_lockdown.sql:25

GRANT INSERT on lead_submissions to anon with WITH CHECK (true) RLS policy means any unauthenticated request can insert arbitrary data (within column types). Intentional design for the marketing lead form, but spam/abuse prevention is entirely the API handler's responsibility with no DB-layer fallback.

Timing equalization and multi-candidate iteration tests are genuine non-vacuous

apps/platform/src/api/handlers/public-v1/__tests__/api-key-verify.test.ts:421

Both invariants are correctly tested. The timing-equalizer test verifies verifySecret is called with the actual dummy hash string (not a Promise). The multi-candidate iteration test confirms a match on the 2nd row is found, killing the candidates[0] simplification. The equalization design is sound — the real scrypt hash format passes all format checks in verifySecret.

Supabase Realtime unaffected by anon table REVOKE

packages/database/drizzle/0076_anon_lockdown.sql:19

Realtime CDC delivery operates at WAL replication level using service-role connections — not subject to table-level grants. Per-subscriber RLS still evaluates under the subscriber's JWT role. The REVOKE does not break any active realtime subscription (cfe_jobs, utility_contract_overview both have auth.uid()-based RLS policies).

Shrink-only H1 ratchet grown with same-branch new files

scripts/check-fcis-boundaries.mjs:47

canonical-form.md § Enforcement Status: 'its allowlist is a shrink-only ratchet of pre-existing deviations.' Both apps/platform/src/api/utils/event-publisher.ts and apps/platform/src/api/utils/public-v1-telemetry.ts were created on this branch and immediately added to the ALLOWLIST with H1 entries in the same PR. The script's own header says 'Shrink it; never grow it silently.' Even with documented justifications, self-allowlisting same-branch new files breaks the invariant. Correct path: route through existing FCIS queries modules, or add a separate architectural exception review.

one-api.md falsely claims scopes enforcement is deferred

.claude/rules/one-api.md:30

Line 30: 'One gate (withMetaGate wrapping withPublicApiAuth) enforces the route's declared auth (+ scopes, when the grants model returns).' The parenthetical implies scopes are not yet enforced. public-v1-meta-gate.ts lines 172-176 confirm scopesSatisfied() is called today on every machine/service request; routes like asset-management.contract.ts declare active scopes. What is deferred is the per-key scope restriction UI (all keys default to ['*']), not the enforcement machinery. Line 439 of the same doc contradicts this. Fix: 'enforces auth + scopes (per-key scope restriction via grants model deferred — all keys currently carry ["*"])'

KNOWN_UNUSED pins dead codes instead of deleting them from codes.ts

apps/platform/src/api/contracts/__tests__/declared-status.guard.test.ts:195

The test's own comment says 'delete the dead code from codes.ts instead' for unused codes. But KNOWN_UNUSED lists 6 codes (EMAIL_REQUIRED, ENTITY_NOT_FOUND, HAS_ASSETS, PAIR_EXISTS, PLAN_NOT_FOUND, SOURCE_NOT_FOUND) that remain registered. CONTEXT_NOT_FOUND survived BAT-301 by a week for exactly this reason. The KNOWN_UNUSED list should be empty — any code in it is deferred cleanup the ratchet was designed to force immediately.

metrics-explore-core.ts::H1 allowlist entry description borrows D5 sweep narrative inaccurately

scripts/check-fcis-boundaries.mjs:51

The entry says 'same class as the handler sweep of 2026-08-08' — but this is from the H1 scope widening (utils/**), not the D5 handler sweep. The description is misleading. The file did pre-exist but was previously invisible to the rule. The entry needs 'H1 scope widening revealed this existing file' wording.

wizard-authuid-wiring mock returns bare {} for RLS db — opaque failure on extension

apps/platform/src/api/handlers/__tests__/wizard-authuid-wiring.test.ts:23

vi.mock('@batu/database/rls', () => ({ createRLSDb: () => ({}) })) returns an object with no methods. If the handler is extended to call .transaction() on the RLS db, the test fails with a TypeError ('is not a function') rather than a meaningful assertion failure. A stub like { transaction: vi.fn(async (fn) => fn({})) } would give a better signal. Non-blocking today.

contract-access list-filter negative test no longer exercises its stated invariant

apps/platform/src/__tests__/integration/contract-access.test.ts:169

The test claims to pin that the list filter has no entity_relationships branch, but since entity_relationships was dropped (BAT-301), the negative fixture (contract reachable only via ER) cannot be constructed. The test now verifies basic cross-org isolation (already covered elsewhere). The assertion is correct but its stated purpose is no longer achievable. Update the comment to reflect what is actually tested.

Rollback-via-thrown-sentinel pattern will drift without a shared helper

domains/utility/src/utility-contract-overview/__tests__/utility-contract-overview.integration.test.ts:640

The `class Rollback extends Error {} + .catch(e => { if (!(e instanceof Rollback)) throw e; })` pattern encodes rollback intent as an exception. Repeating it per test will drift (callers forget the .catch, or use a different sentinel class). A shared `withRollback(async (tx) => {...})` helper owned once by the test suite is the right home.

describeDb guard pattern repeated across integration test files

apps/platform/src/__tests__/integration/rls-machine-claim.test.ts:39

The two-line `hasTestDb + describeDb = describe.skipIf(!hasTestDb)` pattern almost certainly appears in multiple integration test files. The env-var names (POSTGRES_URL, POSTGRES_URL_DIRECT) should be maintained in one place. If a third env-var is added, every file copying this snippet needs updating.

FS walk duplicated inside declared-status test body vs check-fcis-boundaries.mjs

apps/platform/src/api/contracts/__tests__/declared-status.guard.test.ts:166

The recursive walk() and blob-construction loop in the KNOWN_UNUSED test are near-identical to the walk() in check-fcis-boundaries.mjs. The exclusion lists (node_modules, dist, .turbo, .next) are maintained separately and will diverge. Extracting a shared walkSourceFiles() helper would unify them.