senke/veza

History

senke 3cee007d8d Some checks failed Veza CI / Backend (Go) (push) Failing after 0s Details Veza CI / Frontend (Web) (push) Failing after 0s Details Veza CI / Rust (Stream Server) (push) Failing after 0s Details Security Scan / Secret Scanning (gitleaks) (push) Failing after 0s Details Veza CI / Notify on failure (push) Failing after 0s Details fix(distribution,audit): propagate ErrSubscriptionNoPayment to handler + P0.12 closure date + E2E regression TODO Self-review of the v1.0.6.2 hotfix surfaced that distribution.checkEligibility silently swallowed subscription.ErrSubscriptionNoPayment as "ineligible, no extra info", so a user with a fantôme subscription trying to submit a distribution got "Distribution requires Creator or Premium plan" — misleading, the user has a plan but no payment. checkEligibility now propagates the error so the handler can surface "Your subscription is not linked to a payment. Complete payment to enable distribution." Security is unchanged — the gate still refuses. This is a UX clarity fix for honest-path users who landed in the fantôme state via a broken payment flow. Also: - Closure timestamp added to axis-1 P0.12 ("closed 2026-04-17 in v1.0.6.2 (commit `d31f5733d`)") so future readers know the finding's lifecycle without re-grepping the CHANGELOG. - Item G in v107-plan.md gains an explicit E2E Playwright @critical acceptance — the shell probe + Go unit tests validate the fix today but don't run on every commit, so a refactor of Subscribe or checkEligibility could silently re-open the bypass. The E2E test makes regression coverage automatic. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-04-17 12:43:21 +02:00
..
axis-1-correctness.md	fix(distribution,audit): propagate ErrSubscriptionNoPayment to handler + P0.12 closure date + E2E regression TODO	2026-04-17 12:43:21 +02:00
README.md	docs(audit): 2026-04 correctness/accounting findings (axis 1)	2026-04-17 03:21:33 +02:00
v107-plan.md	fix(distribution,audit): propagate ErrSubscriptionNoPayment to handler + P0.12 closure date + E2E regression TODO	2026-04-17 12:43:21 +02:00

README.md

VEZA Audit — 2026-04

Scope — VEZA backend (Go) + web (TypeScript). TALAS software (firmware, PCB reverse-engineering pipeline) is out of scope and will be audited separately when its phase stabilises.

Source state — commits up to a57bb6f78 (v1.0.6.1, 2026-04-17).

Auditor — Claude Opus 4.7 (1M context).

Axes

#	File	Status
1	`axis-1-correctness.md` — correctness / accounting	✅ delivered
2	`axis-2-state-machines.md` — transition matrix + illegal-transition tests	🔲 pending v1.0.7
3	`axis-3-security.md` — attack surface (signatures, rate limits, authz, secrets)	🔲 pending
4	`axis-4-tests.md` — coverage vs reality, failure-injection gap	🔲 pending
5	`axis-5-debt.md` — documented debt vs hidden debt (TODO/FIXME inventory)	🔲 pending

Axis 2 is gated on v1.0.7 landing first — otherwise the transition matrix captures a v1.0.6.1 snapshot that's immediately stale. See v107-plan.md for the sequencing.

Reading conventions

Every finding cites file:line evidence. Structure:

### P{0|1|2}.N — short title
**Evidence** — concrete cites
**Consequence** — what breaks today / tomorrow
**Action** — what to do, with enough detail that an implementer can start
**Criticity** — P0 / P1 / P2 / wontfix (with justification)

P0 = fix within v1.0.7 or earlier (ledger diverges today, or a v1.0.7 commitment is structurally blocked). P1 = v1.0.7 target. Operational visibility / correctness hardening. P2 = v1.0.8+. Nice-to-have. wontfix = justified non-action.

Info needed from ops (not determinable from code)

Tracked in axis-1-correctness.md. Absence of answers becomes a finding in its own right.

Derived deliverables

v107-plan.md — sequencing, dependencies and relative effort for the axis-1 P0 findings + the CHANGELOG-parked v1.0.7 items. Read this before picking up v1.0.7 work.