Foundry

The authz matrix closed with no gaps: every gated read enforces owner-or-admin in the data-access layer itself (lib/reports.ts canView/getReportFor/getPublicReport), generateMetadata goes through the same gate, non-owner and nonexistent slugs are indistinguishable 404s, and no state-mutating endpoint exists beyond auth itself.

All three dynamic slug routes are traversal-proof in the data layer (strict slug regex plus directory-prefix check in lib/reports.ts:92-94 and lib/skills.ts:193-195), and the Behind-the-Build fs reads are hard-whitelisted (lib/docs.ts ALLOWED set); NOTES/PROMPTS/FRICTION are unreachable through any route.

No open redirect exists (fixed-path redirects built from a server-pinned origin; SITE_ORIGIN set in fly.toml so the emailed magic-link target is never derived from a spoofable forwarded host); session trust is JWT-validated via getUser() on every access decision; a failed confirm buffers no cookies and can never half-establish or clobber a session (lib/supabase.ts applyCookies).

Missing auth env locks the gated surface closed with a one-time ops log at every consumer; a malformed report file is logged and skipped rather than 500ing the index; the VERSION file read fails open to 0.0.0, the one direction that can never falsely tell an installed skill it is behind.

Client and server capture no-op without their keys, are never awaited in a request path, and never gate a response; the version endpoint validates against the canonical skill allowlist, disables person-profile processing on its synthetic actor, and serves Cache-Control: no-store.

Skip link, global focus-visible ring, blanket and per-effect reduced-motion kills, aria-live slide announcements, labeled form fields with described errors and aria-busy pending state, 44px targets throughout, and severity, verdict, and gate status always carried by text, never color alone.

globals.css matches DESIGN.md hex for hex including the AA-driven brightened faint tone; no raw hex outside documented mirrors; the display face ships in its single loaded weight; the report-excerpt color exception is honored at all four codified sites; glossary and no-em-dash rules hold across every surface swept including all eleven SKILL_COPY entries.

Every runtime fs-read target is explicitly COPYd into the standalone image (VERSION included), cross-checked against every readFileSync/readdirSync call site; build-arg keys never become runner env; security headers enforce on every route; no dev or debug endpoint exists.

The VERSION file is a single source of truth mechanically enforced: make validate fails on drift in any SKILL.md frontmatter or check URL, SECURITY.md, or a SKILL_SLUGS/skills mismatch in either direction, and CI runs it on every PR and push. The in-skill check command enforces its own opt-out, rate limit, timeout, and fail-silence.

The one confirmed risk of this audit (next 16.2.9 in range for GHSA-m99w-x7hq-7vfj) was fixed in the audited branch and re-verified (next 16.3.1 resolved in the lockfile, build and typecheck green, advisory absent from the post-fix npm audit) before this report was published, alongside two skeptic-verified truth defects: the homepage verdict hue now derives from the verdict via a full-literal class map, and the CI comment now claims detection, not an enforcement no ruleset provides.