5 September 2026 ? Round-10 response ? Working-tree changes, uncommitted

Confirmed authorization gaps and database schema drift

The headline findings in the supplied review are confirmed. This pass fixes six identified runtime/default-configuration findings and tests the changes. It does not claim to close the other eleven findings.

Scoring correction

The earlier 98/96 ratings were too optimistic as repository-wide production-readiness scores. Closing a round's findings does not establish completeness of the review or maturity of every provider and workflow.

Claude's independent 7.0/6.9 baseline is preserved in scores.json. It remains a static-review assessment, not a measured result from this patch. No replacement overall score is assigned here.

Fixes

Finding	Result and boundary
TW-R10-01	Both L3 paths use the same constraint checker. Checkout line-item matching remains unsupported and therefore rejects checkout authorization.
TW-R10-02	Live verification requires nonblank expected L2 audience and nonce. Offline audit opt-out is explicit and recorded; nonce issuance and atomic single-use consumption remain the caller's responsibility.
TW-R10-03	Numeric nonnegative iat/exp and exp > iat are required by default. Only explicit audit policy allows absent L1/L2 claims; L3 always requires both and the one-hour cap.
TW-R10-04	Open payment mandates require an authorized instrument with id/type; L3 must match it.
SA-R10-01	Default Flyway + Hibernate validate, a clean PostgreSQL/JPA parity test and a real SDK application smoke boot. Added V30-V33 for missing migrated columns; CI runs the guard in the full backend suite.
SA-R10-06	Default datasource settings require environment values. Local credential fallbacks are confined to the explicit dev profile.

What the fresh-database check found

Table-existence tests had missed column-level drift. Hibernate validation exposed these additional migration gaps:

V30: completes domain_id to trust_space_id renames on blockchain transactions and role assignments, preserving data and foreign-key targets.
V31: adds the five mapped Accountly linkage and entitlement-cache columns on organizations.
V32: adds template description, schema fields, public visibility and lifecycle status. Legacy tenant-owned templates are backfilled as private.
V33: adds the usage outbox's optional event properties.

Existing migration files were not rewritten. The new guard checks all Hibernate mappings plus SQL-only integrity/recovery indexes and seed data. The application smoke test now inherits Flyway/validate instead of overriding them with Hibernate update.

Validation

VI module: 30 tests passed; module lint passed.
Targeted SaaS checks: 17 tests passed across schema validation, migrations, startup and profile defaults.
Full backend suite: 530 passed, 3 failed, 3 skipped (536 total). One failure was a PostgreSQL connection timeout; two were cluster-admission wait assertions. The global coverage gate remains configured but was not reached. Full-run evidence.
Maintained documentation checker passed; SDK source fingerprint updated for the reviewed working tree.

Logs: SDK round10-vi.log; SaaS round10-schema.log and round10-backend-full.log. The targeted test invocation triggered the whole-repository coverage threshold at 12%, despite its 17 passing tests; the full suite is the appropriate coverage measurement.

Isolated recheck: 25 tests passed, zero failures or skips, including all three full-run failures. Gradle reported BUILD SUCCESSFUL. This suggests timing/environment sensitivity but does not establish its root cause. The recheck excluded the global coverage task for the subset only; clean full-suite reliability and coverage remain unverified. Log: round10-backend-recheck.log.

Open work from the review

TW-R10-05: 7,354 lines of production code with no tests
TW-R10-06: No API-surface control on 106 published modules
TW-R10-07: 108 exceptions swallowed without a log line
TW-R10-08: Coverage measured on 3 of 106 modules
TW-R10-09: 32,692 lint violations permanently baselined
TW-R10-10: No signing, SBOM, or provenance on published artifacts
TW-R10-11: Test dependencies invert the module layering
SA-R10-02: No static analysis on 22k lines of backend Kotlin
SA-R10-03: No dependency update or audit path
SA-R10-04: Tenant isolation holds by convention, not by construction
SA-R10-05: Eleven unused repository methods, several tenant-unscoped

These items have not been silently marked resolved. In particular, broad static-analysis counts need per-module triage, and checking whether a controller references TenantContext would not by itself prove tenant isolation.

Additional validation finding

The first full backend attempt lost database connectivity and then stalled while the Keycloak admin client logged out during context shutdown. Its HTTP client now has a five-second connect timeout and a ten-second read timeout. Two earlier attempts were interrupted: the first after a stalled logout, and the second as Docker cleanup recovered. Neither is counted as a pass. The third full attempt completed with the failures recorded above.

Operational limits

Checkout authorization is deliberately unavailable until line-item matching is implemented. Replay expectations must come from trusted verifier state; applications still need a single-use nonce store. The database checks use isolated PostgreSQL containers and a local KMS with a mocked OIDC decoder, not live staging credentials.

Databases previously created with Hibernate update need an explicit schema/history review before adopting Flyway. This work does not auto-baseline an existing database, deploy a service, or publish an SDK release.

Original round-10 report · Original findings · Remediation status · VI usage and limits