popertots 6bd952238e docs: README + obsidian parity — 2FA/verification-code delivery is dev/test-only stdout log, production fails closed until email/SMS (P6); fixed posture, counts, tiers ...

- TWO_FACTOR_ALLOW_LOG_DELIVERY production opt-in removed from every doc: log delivery reframed as a local DEV ONLY feature while email/SMS is implemented
- Technical Manual: 2FA state + delivery, /api/verify/generate route table, future-work item
- Feature Catalog: SCA posture + verification-code feature
- payments and money processes: relay model + env var reference (removed)
- Overview, User Manual: delivery posture
- test counts, refresh-token grace, session lifetime, deposit advance, gift-card expiry, patch-test notice kept accurate

2026-08-22 00:34:50 +01:00

..

.obsidian

docs: README + obsidian parity with SCA-only posture, flood caps, lockout tiers; dev-script secret bootstrap, stale-backend kill, patch-test backdate

2026-08-22 00:34:50 +01:00

Crussell

docs: README + obsidian parity — 2FA/verification-code delivery is dev/test-only stdout log, production fails closed until email/SMS (P6); fixed posture, counts, tiers

2026-08-22 00:34:50 +01:00

Untitled.canvas

feat: Square 3DS2 SCA primary authorisation for saved-card charges; 2FA demoted to audited backup

2026-08-22 00:34:50 +01:00