Source
Independent Forge (GPT-5.5) cross-vendor authority audit of the platform spine at main (commit 2be0a02). Verdict: CONCERNS.
Severity: HIGH (the flagship coverage gate reports a false invariant)
What
services/api/src/feature_gate.rs:79-90 (/gated/{feature}, reads Json(entitlements): Json<Entitlements> at :81), merged live at services/api/src/lib.rs:84, counted as coverage at xtask/src/coverage.rs:104-131, tests at services/api/tests/feature_gate.rs:23-48.
/gated/{feature} deserializes an Entitlements DTO from the request body and gates on it. The feature-key coverage manifest maps six of the seven baseline FeatureKeys to gate_denies_* tests that POST a body the test author chooses, so the tests pass because the author picks the body. In production the real caller picks too, sending {"features":{"advanced_reports":true}} for a 200. Only AdvancedReports additionally carries the real authenticated gate test (via /gated-feature/{feature}).
Why it is a defect
ADR-0001 is explicit that client-supplied authority is trivially bypassable and the backend must decide. The body-driven /gated/{feature} is not an authority boundary, it is a pure function exposed over HTTP. So the coverage gate reports "every baseline key has backend enforcement" while six of seven are enforced only by a body-trusting route: a green gate over a false invariant. This is the kit's central guarantee, so it matters most.
Fix
Either (a) remove /gated/{feature} from the live app() and re-point the baseline coverage manifest at authenticated /gated-feature/{feature} tests for all seven keys (add the missing six authenticated gate tests), or (b) keep /gated/{feature} strictly as an internal unit harness and forbid GateLayer::Backend coverage credit for any test that posts an entitlements body. The authenticated gate at feature_gate.rs:122-153 is correct: make it the only thing that counts.
Note
Security-sensitive entitlement code: requires human review before merge.
Source
Independent Forge (GPT-5.5) cross-vendor authority audit of the platform spine at
main(commit2be0a02). Verdict: CONCERNS.Severity: HIGH (the flagship coverage gate reports a false invariant)
What
services/api/src/feature_gate.rs:79-90(/gated/{feature}, readsJson(entitlements): Json<Entitlements>at:81), merged live atservices/api/src/lib.rs:84, counted as coverage atxtask/src/coverage.rs:104-131, tests atservices/api/tests/feature_gate.rs:23-48./gated/{feature}deserializes anEntitlementsDTO from the request body and gates on it. The feature-key coverage manifest maps six of the seven baselineFeatureKeys togate_denies_*tests that POST a body the test author chooses, so the tests pass because the author picks the body. In production the real caller picks too, sending{"features":{"advanced_reports":true}}for a 200. OnlyAdvancedReportsadditionally carries the real authenticated gate test (via/gated-feature/{feature}).Why it is a defect
ADR-0001 is explicit that client-supplied authority is trivially bypassable and the backend must decide. The body-driven
/gated/{feature}is not an authority boundary, it is a pure function exposed over HTTP. So the coverage gate reports "every baseline key has backend enforcement" while six of seven are enforced only by a body-trusting route: a green gate over a false invariant. This is the kit's central guarantee, so it matters most.Fix
Either (a) remove
/gated/{feature}from the liveapp()and re-point the baseline coverage manifest at authenticated/gated-feature/{feature}tests for all seven keys (add the missing six authenticated gate tests), or (b) keep/gated/{feature}strictly as an internal unit harness and forbidGateLayer::Backendcoverage credit for any test that posts an entitlements body. The authenticated gate atfeature_gate.rs:122-153is correct: make it the only thing that counts.Note
Security-sensitive entitlement code: requires human review before merge.