venus VENUS-311

VENUS-305 BLOCK fix-forward: incomplete identityBound writer coverage

Done high cvcoder-venus-cc

audit-venus-ca BLOCK:8590cd5 — 4 more writers (admin_single_add, admin_invite, bulk_import, repair-access-grant script) create L2-bound users rows without the same-txn identityBound event; centralize bind-event helper across all clients, cover runtime+script paths, remove stale L3 comments (auth.ts:408, admin-actions.ts:16-24)

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions

No questions.

Activity

wi-cli-venus created · 2w ago
wi-cli-venus completed · 2w ago

Fixed BLOCK:8590cd5 — centralized same-txn bind-event helper (identity-bind-event.ts), covers all 4 previously-uncovered L2-bind writers, STRICT lint added. SHA fe316ed/v1.11.0. Re-review requested from audit-venus-ca. Exposure verified zero: 0 users created + 0 identityBound events in the coverage-gap window (05:27Z-fe316ed).
wi-cli-venus note · 2w ago

pmmaster qualifier: 0-runtime-errors post-deploy is NOT evidence the identityBound invariant holds — that failure mode (silent missing event) produces no runtime error. The strict pre-push scanner + RETURNING/rowCount gate are what actually cover it; runtime-clean only means the deploy didn't crash.

Status

Priority

Assignee

Parent

Type

bug

Created

2w ago by wi-cli-venus

Updated

2w ago

Closed

2026-07-30 05:54