[kiennt048]

Fixes the four findings of issue #78, Emily's QA on make dev-api REAL=core,exposure.

Changes

1. GET/PATCH /core/privacy (modules/core/handlers_privacy.go).
   • Flows: all 11, as the mock's privacyView shows them. Module on/off comes from core's registry. The "configured" facts for flows 3, 10 and 11 come through the nil-safe core.PrivacyFacts port, wired in cmd/vedette/wiring.go with what is true today: AI not configured, default NTP, no OIDC.
   • Storage: shared with the OS update-check switch (keyPrivacy / privacySetting). A test proves that a PATCH turns OS update checks off.
   • Anonymous signal: D-82, nothing is sent, so last_sent is null and payload is {}.
   • PATCH: admin only and strict. Malformed bodies get 400 invalid and change nothing. It is partial: one switch never wipes the other. An empty body writes nothing and audits nothing. Concurrent PATCHes lose nothing.
2. Honest 501. For a 501 the GUI shows "This part is not available in this version yet.", without "Restore sample data" and without a retry button.
3. Setup sign-in. The backend already signed the admin in, with the same cookies, flags and lifetime as a password sign-in and no device cookie. A planted session is never adopted. Setup now writes an auth.login audit row, and the mock's setup writes the same rows in the same order as the backend.
4. Temporary password: it does not reproduce. Create → first sign-in works for every role (TestUsers_TemporaryPasswordSignsInForEveryRole). Steps were requested from Emily on core on dev-api: Privacy page says 'not available', session ends after /setup, temp password from POST /core/users rejected (QA) #78.
5. dev-api: with core real, the MSW handlers of mocked modules use the real session's user and role through /api/v1/me (web/src/mocks/realSession.ts).
   • A viewer still gets 403, a signed-out user gets 401, and nobody is granted admin.
   • A generation guard and writes run through the handler mean a sign-out or a role change is never outlived by a cached /me.
   • It is not in the production bundle, which was checked with a VITE_API_MOCK=off build.

Review

An independent Opus review found 0 Critical and 0 High findings. Everything else is fixed:

• Medium: a race between sign-out and the /me cache.
• Low: the empty PATCH write, stale CONTRACT lines, the mock setup audit rows, and test nits.

Its proof tests are now permanent tests.

Deferred (.ai/deferred/fix-core-qa-78.md), both pre-existing:

• ogen body-decode errors carry no field path (D-73, all endpoints);
• the production bundle includes msw and the mock stores through features/core/logExport.ts.

The lead does both in separate PRs.

Local checks

make check exit 0: Go -race, golangci-lint 0 issues, govulncheck clean, tsc, 27 vitest files / 954 tests. Linux lint 0 issues. main (#80, #83) was merged in afterwards; go vet is clean.

Closes #78.

🤖 Generated with Claude Code