create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/security/independent-review-packet.md

@@ -0,0 +1,369 @@
+# C11.10 independent security-review packet
+
+This is a briefing packet for an independent reviewer. It is **not** the
+review. C11.10 stays open until a reviewer who did not author the surfaces
+below has resolved every critical/high finding and dispositioned every lower
+one.
+
+Prepared 2026-09-12 from the tree at this change. Threat surfaces, existing
+tests, and known residuals only — no claim that the list is empty.
+
+## 2026-10-03 automated-alert triage (preliminary)
+
+This update is preparation for C11.10, not independent sign-off. GitHub CodeQL
+reported thirteen open alerts when this round began. The storefront and visual
+editor changed after the original packet was written, so the reviewer must
+walk their public and owner paths as well as the surfaces below.
+
+| Alerts | Initial disposition and evidence to check |
+| --- | --- |
+| #4, #2, #22 | This change restricts rich-text links to web/mail/phone/relative URLs, removes modulo bias from recovery-password generation, and replaces a slow mobile slug trim with linear scans. Focused regressions cover each. Confirm CodeQL closes these on `main`. |
+| #1 | The recovery CLI deliberately displays a newly generated password once. It does not run inside an HTTP request, but redirected terminal output can retain the secret. Review its operator instructions and whether a TTY-only display is warranted before dismissing the alert. |
+| #5, #6 | API keys are 32 random bytes authenticated with HMAC-SHA256; the mail webhook hashes two presented Basic values for constant-time comparison, not for stored password verification. Confirm those assumptions and key lifetimes before treating the password-hash warnings as false positives. |
+| #7, #11–#13, #18 | The importer uses regex for partial HTML extraction and entity decoding. Committed content passes through the parse5 allowlist in `src/modules/cms/blocks/html.ts`, but preview and malformed-input behavior still need a direct review. |
+| #9, #10 | These are in `scripts/a11y-smoke.mjs`, a test utility rather than a served route. Confirm no untrusted CI input reaches its generated markup. |
+
+The alert numbers refer to the repository's Code Scanning list. No alert is
+treated as resolved merely because this table names it.
+
+## 2026-10-05 release security repairs (awaiting independent review)
+
+The current automated scan has ten open alerts. This repair addresses importer
+alerts #7, #11–#13 and #18 with parse5 text extraction and CMS-allowlisted preview
+markup; `tests/core/importers.test.ts` covers malformed script attributes, encoded
+URL schemes, numeric references and one-pass decoding. The accessibility helper
+(#9/#10) uses JSDOM outside-only execution; it no longer enables page scripts and
+then attempts regex removal. The browser-like parser determines document structure.
+`tests/core/a11y-smoke.test.ts` exercises scripts with closing angles in attributes.
+
+Recovery CLI alert #1 is addressed by never echoing supplied/generated passwords.
+Generated credentials go to an exclusive mode-0600 file in a mode-0700 directory;
+stdout contains only the path and salted scrypt SQL. Tests prove compatibility
+with the app verifier, filesystem permissions and secret absence from output.
+Operators must retrieve/delete the private file on the machine or container where
+they ran recovery. The supplied-password form can still leave shell-history and
+process-argument exposure; prefer generated recovery in a secure local shell.
+
+Alerts #5/#6 remain candidates for false-positive disposition, not dismissed here:
+API keys contain 32 cryptographically random bytes and use a keyed HMAC for an
+indexed lookup, not a human-password digest. Postmark compares hashes only to
+normalize timing of two transient presented Basic values; neither hash is stored
+as a password verifier. An independent reviewer must confirm these assumptions.
+The refreshed CodeQL run must also confirm the repaired alerts close on main.
+This section does not check C11.10 or supply independent sign-off.
+
+## 2026-10-08 adversarial implementation audit
+
+Three agents reviewed auth/customer privacy, customer money/booking paths and
+platform/MCP/consent. The integrating agent reproduced public CMS disclosure
+and editor races. Repairs, baseline assertions and operational limits are in
+`security/adversarial-audit-2026-10-08.md`. Review the published-field projection,
+trusted renderer, gallery privacy backfill and archive invalidation, atomic
+reset redemption, customer record projections, billing ownership/settlement
+checks and durable unsubscribe delivery in particular.
+
+These are implementation tests by coding agents, not independent review.
+C11.10 remains unchecked. Validate private object-provider policy and external
+mail/payment acceptance separately; a green mocked provider is not evidence of
+live delivery or settlement.
+
+## How to use this packet
+
+1. Read `SECURITY.md` for reporting, dependency policy, and 2FA/recovery.
+2. Work the surfaces in the order below. Each names the code, the tests that
+   already exist, and the residual that a reviewer still has to judge.
+3. Disposition findings in the pull request that closes C11.10. Do not treat a
+   green CI run as the review.
+
+## Surfaces
+
+### Auth
+
+**What it is.** Email + password for staff, TOTP/WebAuthn/recovery for
+privileged grants, magic links for customers, session cookies, API keys,
+CSRF, rate limits, security headers, CSP.
+
+**Code.** `src/core/auth/`, `src/core/http/csrf.ts`, `src/core/http/csp.ts`,
+`src/core/http/headers.ts`, `src/core/security/rate-limit.ts`,
+`src/core/apikeys/`, `app/api/auth/`, `app/(admin)/login/`,
+`app/(admin)/security/`.
+
+**Existing tests.** `tests/core/passwords.test.ts`, `two-factor.test.ts`,
+`session-management.test.ts`, `http-auth.test.ts`, `http.test.ts`,
+`csrf.test.ts`, `csp.test.ts`, `csp-reports.test.ts`,
+`security-headers.test.ts`, `rate-limit.test.ts`, `apikeys.test.ts`,
+`change-password.test.ts`, `password-reset.test.ts`,
+`customer-magic-links.test.ts`, `invitations.test.ts`, `roles.test.ts`.
+
+**Residuals for the reviewer.**
+
+- Privileged grants require 2FA before module grants become usable; confirm
+  there is no grant path that skips enrollment (invitations, role edits, API
+  keys).
+- `SESSION_SECRET` rotation invalidates sessions, API keys, pending links,
+  TOTP seeds and recovery codes. Break-glass is a CLI; confirm it cannot be
+  reached from HTTP.
+- Customer magic links vs staff passwords: confirm a stolen customer link
+  cannot mint a staff session.
+- CSP report ingestion is minimized; confirm it cannot be used as a storage
+  oracle.
+
+### Payments
+
+**What it is.** Hosted checkout adapters, offline ledger, authenticated
+provider events, refunds, disputes, saved methods. Money is integer minor
+units.
+
+**Code.** `src/adapters/payments/`, `src/modules/invoicing/`,
+`app/api/` payment webhook routes, `deploy/commerce-payments.md`.
+
+**Existing tests.** `tests/core/payment-adapters.test.ts`,
+`payment-provider-service.test.ts`, `invoicing.test.ts`,
+`money-arithmetic.test.ts`, `advanced-money.test.ts`.
+
+**Residuals for the reviewer.**
+
+- Live Stripe/PayPal settlement is still adapter doubles in the C11.05
+  journey. The webhook HMAC and idempotent event table are real; a live
+  charge is not claimed.
+- Duplicate provider events must not double-apply money
+  (`onConflictDoNothing` on `provider_event_id`). Confirm amount-drift
+  refusal still holds when the first event was `ignored`.
+- Manual/offline money is owner-attested. Confirm it cannot be raised from
+  an API key without step-up.
+
+### Webhooks (outbound)
+
+**What it is.** Signed outbound deliveries, SSRF allowlist, pinned
+transport, retry/backoff, pause after repeated failure, replay.
+
+**Code.** `src/core/webhooks/`, `deploy/webhook-delivery.md`.
+
+**Existing tests.** `tests/core/webhooks.test.ts` (signature, replay window,
+metadata SSRF, 500 retry, pause, inspect/replay).
+
+**Residuals for the reviewer.**
+
+- Delivery URLs refuse cloud metadata and private ranges. Confirm IPv6, DNS
+  rebinding, and redirect-follow behaviour on the pinned transport.
+- Signature timestamp tolerance is 300s. Confirm receivers documented in
+  `deploy/webhook-delivery.md` match the implementation.
+- Replay is a new delivery with a new idempotency key, not a byte-for-byte
+  resend. Confirm that is the intended contract.
+
+### MCP / agents
+
+**What it is.** JSON-RPC MCP over HTTP, tools derived from the service
+registry, agent autonomy/budgets/approvals, untrusted-input envelope.
+
+**Code.** `src/mcp/`, `src/core/agents/`, `src/core/apikeys/`.
+
+**Existing tests.** `tests/core/mcp.test.ts`, `agents.test.ts`,
+`agents-injection.test.ts`, `agents-autonomy.test.ts`,
+`agents-budgets.test.ts`, `agents-approvals.test.ts`,
+`agents-pause.test.ts`, `internal-services.test.ts`.
+
+**Residuals for the reviewer.**
+
+- MCP tests speak the protocol as this tree understands it; they do not
+  prove a real MCP client. Probe with one.
+- System services are hidden from MCP (`permission !== "system"`). Confirm
+  `external: false` and `hiddenFromMcp` cannot be bypassed by tool-name
+  guessing.
+- Untrusted input is marked and must not interpolate into owner-facing
+  prose. Injection tests exist; a reviewer should add a payload the suite
+  does not already contain.
+- Autonomous writes are budgeted and approval-gated. Confirm a paused or
+  over-budget agent cannot complete an in-flight run.
+
+### OAuth (mail and calendar)
+
+**What it is.** One-time hashed state, least-privilege scopes, encrypted
+refresh tokens bound to row AAD, claim-before-exchange so a failed token
+call cannot replay state.
+
+**Code.** `src/core/mail/oauth.ts`, `src/core/connections/oauth-core.ts`,
+`src/core/connections/calendar-oauth.ts`, `src/core/connections/crypto.ts`.
+
+**Existing tests.** `tests/core/mail-oauth.test.ts`,
+`mail-oauth-callback.test.ts`, `calendar-oauth.test.ts`,
+`connection-grants.test.ts`, `connections.test.ts`.
+
+**Residuals for the reviewer.**
+
+- State is consumed before the provider is called. A reviewer should confirm
+  every OAuth family (mail send, mail read, calendar) shares that order.
+- Tokens never appear in API responses. Confirm logs and doctor output match.
+- Losing `CREDENTIAL_KEY` without `CREDENTIAL_KEY_PREVIOUS` makes every
+  connection `needs_reconnect`. Confirm ciphertext is not deleted.
+
+### Plugins
+
+**What it is.** Signed registry index, hashed install directory, isolate
+loader, permission contract, update/rollback.
+
+**Code.** `src/core/plugins/`, `packages/plugin-kit/`,
+`deploy/first-party-plugins.md`.
+
+**Existing tests.** `tests/core/plugin-contract.test.ts`,
+`plugins-lifecycle.test.ts`, `first-party-plugins.test.ts`,
+`plugin-scaffold.test.ts`.
+
+**Residuals for the reviewer.**
+
+- Install trusts a signed index and a directory hash. Confirm a mutated
+  file after install is refused on enable, not only on update.
+- Plugin permissions cannot mint `network:external` (or equivalent) without
+  declaring it. Importers already require that; other plugin kinds may not.
+- Rollback of a plugin is not rollback of data it wrote. Call that out.
+
+### Updater
+
+**What it is.** Signed release feed, preflight, snapshot, smoke, cutover,
+automatic rollback, target-specific image swap.
+
+**Code.** `src/core/update/`, `deploy/update-*.md`.
+
+**Existing tests.** `tests/core/update-apply.test.ts`, `update-preflight.test.ts`,
+`update-feed.test.ts`, `update-policy.test.ts`, `update-check.test.ts`,
+`update-escalation.test.ts`, `update-targets.test.ts`, `update-cli.test.ts`,
+`update-admin.test.ts`.
+
+**Residuals for the reviewer.**
+
+- `failAt` is a test seam on the local target. Confirm production targets
+  cannot pass it from HTTP.
+- Feed signatures and key rotation are documented in `deploy/release-feed.md`.
+  Confirm the embedded public key matches what CI publishes.
+- An interrupted cutover must roll back. C11.13 drills exercise migrate/
+  smoke/cutover; a reviewer should still try a killed PID on a real target.
+
+### Uploads / media
+
+**What it is.** Storage adapter (S3/Replit/local), key sanitization,
+malware scanner seam, renditions, watermarks, capture sessions.
+
+**Code.** `src/adapters/storage/`, `src/adapters/malware/`,
+`src/core/media/`, `app/media/`.
+
+**Existing tests.** `tests/core/storage.test.ts`, `malware.test.ts`,
+`media.test.ts`, `media-capture.test.ts`, `media-watermark.test.ts`,
+`media-transfer.test.ts`.
+
+**Residuals for the reviewer.**
+
+- `storageKey()` and the local adapter both refuse path escape. Confirm S3
+  keys cannot overwrite another prefix.
+- ClamAV is optional; `none` states that plainly. Confirm production
+  recipes do not silently ship `none` as if scanned.
+- Local storage refuses production unless `FREEHOLDER_UNSAFE_LOCAL_STORAGE=1`.
+
+### Customer privacy
+
+**What it is.** Consent evidence, data requests, export/erasure artifacts,
+portal self-service, retention TTL on artifacts.
+
+**Code.** `src/core/privacy/`, `app/privacy/`, `app/(admin)/` privacy
+screens, `deploy/privacy-rights.md`.
+
+**Existing tests.** `tests/core/contact-privacy-rights.test.ts`,
+`record-participation.test.ts`, `ownership-export.test.ts`,
+`analytics-consent.test.ts`, `sms-consent.test.ts`.
+
+**Residuals for the reviewer.**
+
+- Artifact download is session-bound and `no-store`. Confirm a guessed UUID
+  404s without leaking existence beyond timing.
+- Erasure vs retention exceptions: confirm a legal hold actually blocks
+  fulfill, and that merge does not resurrect erased rows.
+- C11.14 still names undelete-every-row as open. Retention is a bounded
+  per-kind policy registry plus `core.applyRetention`, not a TTL on every
+  table. Product-wide search is `search.query` over a live registry; do not
+  treat contact-privacy tests as coverage of every user-owned table.
+
+## Cross-cutting controls already in CI
+
+| Control | Where |
+|---|---|
+| Dependency audit, no high/critical, expiring exceptions | `scripts/dependency-audit.mjs`, `security/dependency-audit-exceptions.json` |
+| Secret scan | TruffleHog in `.github/workflows/ci.yml` |
+| CodeQL | `codeql` job |
+| Dependency review | `security` job on pull_request |
+| Pinned Actions, no `pull_request_target` | `scripts/workflow-integrity-gate.mjs` |
+| License headers | `scripts/license-headers.mjs` |
+| Service-layer gate (no Drizzle in routes/MCP) | contract suites |
+| Money gate (no float on charge paths) | `tests/core/money-arithmetic.test.ts` |
+
+The ledger of accepted dependency advisories is currently empty.
+
+## Out of scope for this packet (named so they are not forgotten)
+
+- Independent WCAG review (C11.12).
+- Performance budgets (C11.11) — harness ships beside this packet; budgets
+  are in MASTER.md §15.1.
+- Failure drills (C11.13) — `tests/core/c11-13-failure-drills.test.ts`.
+- Live provider accounts. Adapter doubles and loopback receivers are what
+  CI runs.
+
+## Reviewer sign-off (leave blank)
+
+| Field | Value |
+|---|---|
+| Reviewer | |
+| Date | |
+| Critical/high open | |
+| Lower findings dispositioned | |
+| Follow-up tickets | |
+
+### paradisemodern Comms surface (C3.13)
+
+The de-facto first-party voice/video provider is paradisemodern's Paradise
+Comms (owner decision 2026-09-27): prod `https://paradisemodern.com/v1`,
+staging `https://comms-staging.paradisemodern.com/v1`; auth is a per-site
+`x-api-key` (carrying comms scopes) or a legacy portfolio bearer token.
+Capabilities `comms.calls/rooms/streams/conversations` are reported by
+`/api/integration/capabilities`.
+
+**Code.** The first-party adapter is the Paradise one —
+`plugins/voice-video/paradise.ts` (HTTP client), `paradise-provider.ts`
+(seam mapping), `settings.ts` (§41-encrypted secrets in module settings),
+`webhook.ts` plus `app/api/plugins/voice-video/webhooks/paradise/route.ts`
+(inbound relay), with `daily.ts` retained as optional non-first-party code.
+**Tests.** `paradise-adapter.test.ts`, `paradise-flow.test.ts`,
+`paradise-webhook.test.ts`, `daily-adapter.test.ts`, `daily-flow.test.ts`,
+`plugin-claims.test.ts`, `internal-services.test.ts`, and the
+unconfigured-provider browser journey.
+
+Provider requests use a fixed HTTPS API origin, bounded bodies, timeouts and
+no redirects. Room and recording identities must match the persisted
+provider account. On the shipped Daily path: transcript downloads use
+public-DNS-pinned transport without the API credential, private rooms
+expire with separate room-bound host/guest tokens expiring within 30
+minutes, provider shutdown expires the room, ejects participants and
+verifies empty presence (local state alone is not accepted as that
+evidence), and expiring leases reject stale provider results with provider
+I/O outside database transactions. On the PM path, credentials are TTL
+JWTs with TURN, room end persists terminal state and awaits LiveKit
+`DeleteRoom` (`media_ended`, with 503 `media_termination_pending`
+retryable), recordings land in DigitalOcean Spaces and are listed, read
+and erased through the 2026-09-28 recording lifecycle (playback URL is a
+public unsigned Spaces URL — a short-lived access window, never a shareable
+link), webhooks are HMAC-SHA256 signed (`Webhook-Signature:
+t=<ts>,v1=<hmac>`) and verified with a five-minute timestamp window before
+any database effect, and the inbound relay is idempotent by envelope id in
+`voice_video_webhook_deliveries`. The prepaid-budget 402 gate applies to
+site-key callers and is surfaced with balance and top-up URL, never retried
+past.
+Token-bearing result fields use explicit `Token` names for central
+redaction and never enter room/artifact list rows. Guest links are
+generated for manual sharing, not sent automatically.
+
+**Residuals.** Review the actual PM surface against a live paradisemodern
+instance: credential TTL and TURN handling, room policy enforcement, the
+media-termination retry, and webhook signature verification end to end.
+Provider-side erasure rides `DELETE /v1/recordings/:id` (retryable 503 keeps
+the PM row and the receipt pending; 409 mid-egress defers to the durable
+job). Transcripts are unavailable until PM ships them. Live paradisemodern
+acceptance remains C3.13 work. Review [provider erasure and recovery](../deploy/provider-recording-erasure.md),
+including the PM-path honesty note and failed-job recovery. This
+implementation and its mocked HTTP tests are not an independent review.

package/dist/template/security/project-audit-2026-09-13.md

@@ -0,0 +1,127 @@
+<!--
+Copyright (C) 2026 Tony Aly
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Project audit — 2026-09-13
+
+Audit of the checkout inherited from the prior agent session, starting at
+`7cd57a5`. This is an evidence report, not a roadmap or completion authority.
+`MASTER.md` §43 remains the sole completion checklist. Findings below are
+repairs merged through PR #361 (`96570e7`); this document does not claim deployment or an
+independent reviewer sign-off.
+
+## Findings and repairs
+
+| Finding | Impact | Repair and executable evidence |
+|---|---|---|
+| Gated community reads accepted a member email from an anonymous caller. Member posting and moderator actions also derived identity from submitted email. Gated reporting returned post contents without checking membership. | High: private discussion disclosure and member/moderator impersonation through public services. | Session-linked `contacts.userId` is the identity for member reads, posts and moderation. Reports check the same read boundary. Public pages/actions propagate the existing authenticated actor. `tests/core/community-rooms.test.ts` passes seven tests including forged email, signed-in outsider, anonymous moderator, member impersonating a moderator, and genuine member behavior. The gated-community browser journey passes with an anonymous caller, outsider, and signed-in member posting through the form. |
+| Managed-agent proposals resolved private services with the internal registry; approval execution did the same. | High: the gateway could park private payment apply phases and reach internal queries. | Resolve targets with the public dispatcher’s visibility filter at proposal and approval time. Both regressions failed before repair; all 24 agent autonomy/approval tests passed after repair. |
+| Capture session IDs bypassed media authorization, and upload staging accepted caller-supplied storage metadata as a public service. | High: private capture capabilities could be disclosed and sessions modified without media authority. | ID access requires the exact media scope and read-only access redacts bearer URLs/upload handles, phone tokens retain the capability lane, completed-upload staging is system-only, and phone binding accepts only uploads made through that link. All 14 capture/mobile regression tests passed after repair, including the ordinary proxy and reserved-upload paths. |
+| Global search treated any scope with a matching module prefix as read authority, and used contact/CRM grants for notes, conversations and tasks. | High: a key authorized only for contact creation could read existing contact names and emails; related staff grants crossed data boundaries. | Each source names an existing scoped read service. Search uses its registered permission and ordinary authorization function. The new regression failed before repair with a leaked contact and passes afterwards. All 16 tests in `tests/core/c11-14-search.test.ts` passed. |
+| Print, marketplace and voice/video adapters unconditionally returned test fixtures, including synthetic vendor IDs, transcripts and durations. | High operational impact: a deployed instance could claim work was accepted by a vendor when no request was sent. | Provider factories refuse outside `NODE_ENV=test`. Existing claim/apply workflows record their error and retain retry state. Provider acceptance also no longer marks the catalog fulfillment shipped or uses a vendor order ID as carrier tracking. `tests/core/plugin-provider-boundary.test.ts` exercises production, development and test behavior. This does not implement the missing live providers; C3.13 remains open. |
+| Provider claim paths did not consistently exclude simultaneous callers. | Duplicate vendor operations and competing progress updates. | Print and voice/video claims now lock their existing rows and refuse an already pending recording. Seventeen plugin integration/concurrency tests passed. Marketplace sync now fences expired workers and atomically imports contact/invoice/channel-order records. Its regression tests pass for exclusive claims, expiry/recovery, stale import/checkpoint refusal, idempotency and rollback. |
+| The performance fixture declared five record families but inserted only contacts. Revenue measurements read an empty invoice table. “Server render” only resolved page data. | Misleading completion evidence. | The fixture inserts and verifies all declared families, linked product variants/order lines and paid invoices with known totals. CMS timing now includes actual block rendering and HTML serialization. Small, medium and large runs pass locally; whole-page HTTP/layout and reference-target timing remain unproved. Asset rows are metadata fixtures, not stored media files. |
+| A performance run could succeed with its database test skipped. NaN or negative measurements could pass comparisons. Large pagination bypassed requested auxiliary measurements. | False-positive release gates. | Explicit test-database requirement, required passing measurement in the runner report, finite/nonnegative validation, and requested-surface enforcement. Regression tests cover missing database, bad clocks and missing requested browser data. |
+| Contact pagination sorted only by creation timestamp. | Imports can create timestamp ties, allowing repeated or omitted contacts across OFFSET pages. | Unique ID breaks ties; `0006_contact_pagination.sql` adds the supporting index. Tests assert exact order for 60 tied contacts and distinct first/second/final pages at 100,000 contacts. |
+| Any failure to pull the previous release image made the upgrade gate exit successfully. | Missing rollback evidence could pass CI after registry/network failure. | The gate now fails with a concrete diagnostic. A subprocess test supplies a failing Docker command and asserts a nonzero result before any database operation. |
+| SDK generation returned success when the live-registry generation test skipped. | A stale client contract could be presented as freshly generated. | Require a disposable database and a passing live-generation assertion in the test report. Subprocess tests reproduce missing database and a successful runner whose generation step skipped. Regeneration with a real database passes all eight SDK tests. |
+| Accessibility list checks labelled inherited theme state as “light”; 22 named admin lists had no browser scan. | Incomplete/mislabelled accessibility evidence. | Set and assert each theme explicitly, and cover all 22 named omitted lists. The expanded production-build Chromium accessibility journey passes. It does not prove every detail form, complete keyboard workflow, viewport and locale combination. |
+
+The audit also reopened C0.11, C11.09 and C11.16. Static evidence stamps and
+section inventories did not establish the full completion claims; C11.16's
+old test explicitly asserted completion while requiring unfinished work.
+The corrected test refuses that combination.
+
+## Additional catalog authorization findings — 2026-09-14
+
+`catalog.getOrder` was public and returned private order addresses and line
+items for a supplied UUID. The regression reproduced anonymous disclosure.
+The query now requires scoped catalog read authority, matching its staff UI.
+`tests/core/catalog-orders.test.ts` covers anonymous/customer/unrelated staff
+and write-only key refusal, plus authorized staff and exact read-key access.
+The same review reproduced anonymous raw inventory holds with caller-chosen
+holder IDs/expiry, and stock-notification enrollment for a supplied contact ID.
+Raw holds now require catalog management; guest carts already use checked
+system composition. Enrollment verifies the signed-in contact or catalog
+management authority. Inventory/procurement tests cover the denials, unchanged
+stock after refusal, own-contact enrollment and cross-contact refusal. This
+follow-up remains separate from the frozen #361 evidence above and does not
+constitute independent security review.
+
+## Additional cart and wishlist findings — 2026-09-14
+
+Four regressions reproduced ID-only cart reads, unauthenticated cart edits,
+write-token disclosure to view-only readers, and anonymous saved-cart/wishlist
+access by contact ID. Cart operations now check the matching private token,
+verified contact ownership or the exact catalog scope. Read-only projections
+redact tokens; scoped mutation composition does not mint a broader capability.
+Saved profile records require contact ownership or catalog authority. Gallery
+sessions do not authorize arbitrary cart IDs, and promotions use the same cart
+boundary. Tests cover guest tokens, own/cross-contact access, exact API scopes,
+closed-cart refusal and the existing commerce journeys. This is additional
+repair evidence, not an independent review or a completion claim.
+
+## Verification scope
+
+Completed local evidence:
+
+- Production build and standalone artifact gate: passed; no source/environment leakage.
+- Fast gates: typecheck, lint, licensing, changelog, plan and 34 required contract suites passed (300 tests, one explicitly database-dependent skip). The frozen audit revision passed these gates.
+- Dependency audit: no known advisories reported by the configured live scanner.
+- Package artifact gate: seven packages packed, installed and exercised.
+- Local dump/restore rehearsal: 353 tables and 147 rows matched, then exported. This fixture had no media objects and did not exercise separate hosting providers.
+- Browser journeys: all nine production-build journeys passed, covering visitor-to-paid,
+  app-free capture, setup/auth/editor/publishing/forms/contacts/translations/API/MCP/recovery, demos, guidance and plugins. This run preceded the later capture authorization repair.
+- Browser accessibility: expanded run passed in both themes, including 22 additional owner lists.
+- After the capture authorization repair, the capture, registry and authenticated gated-community browser journeys passed again (three tests).
+- Focused search, community, provider, SDK and performance regressions described above.
+
+Mobile TypeScript checks and both Android/iOS native bundle exports passed.
+The plugin/performance integration rerun passed all 25 tests. The full database
+suite was restarted on a separate disposable PostgreSQL instance with fsync,
+synchronous_commit and full_page_writes disabled to avoid spending hours flushing
+empty test tables. The existing server was not changed. This functional run is
+not crash-durability or reference-performance proof. Subsequent changes have
+dedicated reruns. The first complete run reported 3,534 passed, 17 inapplicable recipe cases
+skipped and two failures from service snapshots loaded before the later
+shipping/capture fixes. Both affected files subsequently passed. The frozen-code
+rerun subsequently passed all 339 files: 3,541 tests passed and 17 inapplicable
+recipe cases skipped. Hosted CI and the protected merge queue passed, including
+Docker recipe, public surface and upgrade gates. PR #361 merged without bypass.
+
+## Additional note authorization findings — 2026-09-14
+
+Two regressions reproduced private-note disclosure. `notes.pin` accepted another
+staff member's private-note ID and returned its body after updating the pin.
+`notes.history` checked authorship only for user actors, so an API key with the
+history scope could read revisions hidden by `notes.list`.
+
+Pinning now includes note visibility in the update predicate. History uses the
+same visibility filter as the list in both its initial lookup and revision
+query, including API-key callers. Edit/remove lock the note before authorizing
+and mutating it so a concurrent visibility change cannot invalidate the check.
+The previously failing regressions pass; all 51 note, search and contact-privacy
+tests pass. Author pinning and shared-note API history remain covered. This is
+an implementation repair, not an independent review or completion sign-off.
+## Hidden location read boundary
+
+A regression reproduced anonymous access to hidden location addresses through
+`locations.list` with `includeHidden`. The repair requires location read scope
+for that option and filters hidden records from public ID/slug lookups. Tests
+cover anonymous and unrelated staff, write-only and exact read API scopes, and
+location viewers. A second regression reproduced address snapshots remaining
+in generated-page SEO after hiding a location. Public page and sitemap reads
+now enforce linked location visibility before event delivery; the listener
+then unpublishes the page. POS and social selectors request hidden locations only for
+staff with location read access. This is an additional internal repair, not an
+independent security sign-off.
+
+## Limits of this evidence
+
+No live payment settlement, provider account connection, production deployment,
+physical-device interaction, reference-droplet performance measurement or owner
+completion signature was performed. Provider fixtures are test evidence only.
+An independently signed security review is still required by C11.10. The
+remaining completion requirements, including record restore, real providers,
+RTL and device proof, stay in `MASTER.md`; none are waived by this audit.

package/dist/template/seed/README.md

@@ -0,0 +1,86 @@
+# seed/ — the demo business
+
+**Aurora Coast Photography**: a fictional one-person photography studio in the
+Comox Valley, and the site a fresh Freeholder can fill itself with.
+
+It exists for three reasons, and all three want it to be *good* rather than
+merely present:
+
+- **§15.2's SEO gate crawls it.** A demo site that fails the doctrine cannot be
+  used to prove the doctrine holds, so the gate would be checking nothing.
+- **§25's plugin dev harness boots it.** This is the site a contributor sees
+  first, and the one they form an idea of the platform from.
+- **§3 promises "a fresh deploy is instantly explorable."** An empty instance
+  is a tutorial. A populated one is a product.
+
+## What is here
+
+```
+seed/
+├── demo/
+│   └── content.ts            # Aurora Coast Photography — first-run / SEO gate
+└── README.md
+```
+
+Content only. The installer is a service — `demo.install`, in
+`src/modules/seed/` — because everything it writes goes through the ordinary
+services, so the demo can only contain content an owner could have produced by
+hand. If the seed ever needs a table write the service layer forbids, either
+the seed is wrong or the service layer is.
+
+## Installing it
+
+```sh
+# A production demo deploy that arrives populated. Read once at boot; refuses
+# if the site already has pages, and there is no route that can trigger it.
+FREEHOLDER_SEED_DEMO=1
+```
+
+`pnpm dev` does the same by default on a pristine database, so a new
+contributor's first request to `/` is the complete site rather than setup
+scaffolding. `FREEHOLDER_SEED_DEMO=0` opts into a blank development instance
+when working on the first-boot journey. An implicitly seeded development
+database must have neither an owner nor a business profile, so this convenience
+cannot overwrite setup work that has not created its first page yet.
+
+…or call `demo.install` as the owner from the admin, the API, or MCP — one
+implementation, whichever door it is reached through (§2 principle 7).
+
+## Editing the copy
+
+`content.ts` is data. Change a page's words, add a page, reorder the nav —
+none of that is a change to behaviour. But `tests/core/seed-demo.test.ts`
+asserts the *shape* of it, and will fail if an edit breaks the doctrine the
+demo exists to demonstrate:
+
+- every page within three hops of the root (§5's RIBA rule)
+- exactly one H1 per page
+- a unique title and description on every page, within the lengths search
+  results actually truncate at
+- alt text on every image that describes the picture rather than naming the file
+- no button linking to a page that does not exist
+
+That list is the checkable half of §5, asserted against the content directly —
+where a failure names the page, rather than in a crawler where it names a URL.
+
+## The images
+
+Generated at install time from SVG gradients, not committed as photographs.
+Real images would be somebody's copyright, tens of megabytes in a repository
+that has to stay cloneable, and a licence question on every fork. The generated
+ones still exercise everything that matters: sharp reads them, renditions are
+built at every width, `<picture>` gets real AVIF and WebP sources, and pages
+reserve intrinsic dimensions so nothing reflows when they land.
+
+## Scenario contributions
+
+The complete Aurora Coast site above remains the pristine-development and
+public-gate fixture. Separately, modules and plugins now contribute versioned,
+localized, purgeable scenario fixtures through their `onboarding` manifest
+loader. **Admin -> Demo scenarios** assembles those contributions through the
+transactional `demo.load`, `demo.reload`, `demo.reset` and `demo.purge`
+services, with exact record provenance and verified cleanup.
+
+The current-module scenario still proves the extension seam with CMS and Forms.
+Complete creator, service-business, shop and everything journeys assemble the
+same seam from C5–C9 contributions — see `deploy/demo-scenarios.md`.