Fifth fresh-eyes review pass (5 agents: goal, QA, code-quality, security,
context-mining). Code verdict: PASS across all five. The findings this round
were documentation-only — the code changes from round 4 (per-dispute chargeback
alerting, single-source clawback, 2FA lockout coherence) were verified correct.
Docs:
- Test counts corrected everywhere to the ACTUAL compiled number under
-tags test,dev: 2,137 (README, Technical Manual, Testing Architecture doc).
Prior docs claimed 2,151 / 2,133 — neither matched the compiled count, and
the raw func-Test grep (2,154) includes 17 build-tag-excluded tests.
- Technical Manual 2FA Gate: corrected the false 'fresh verification code is
generated ... when disabling' claim. The disable flow REUSES a still-valid
pending code and only mints fresh when none exists; the 'always-fresh on
disable' alternative was deliberately NOT adopted (an out-of-band [2FA]-log
code cannot be submitted within the same request that generates it). This
now matches the code and the round-4 commit's own rationale.
- Technical Manual: documented the accepted residual 2FA brute-force exposure:
a fresh-code delivery resets the shared 5-attempt counter, so an attacker
who already holds the victim's password can loop disable to obtain unlimited
fresh codes (6-digit guessing bounded only by the per-IP rate limit and
10-min TTL). Documented rather than fixed because a hard lockout would strand
a legitimate code-lost user with no email/SMS recovery (P6).
- README: corrected the -count=10 verification claim — handlers/payments and
handlers/webhooks share package-global state (Square mock ledger, in-memory
webhook dedup cache, fixed-ID test rows) that leaks across in-process
iterations, so -count>1 is unreliable there; use -count=1 for those two.
Verification: build clean, user/webhooks/payments packages green via
run-tests.sh, frontend builds, svelte-check 0 errors.
popertots
39cc42b239