test(cards): proposed R5 integration of #773 onto #811 (post-repair-C) by NewWorldVenture · Pull Request #876 · NewWorldVenture/Bubaly

NewWorldVenture · 2026-10-03T11:50:22Z

Proposed integration: #773's characterization tests onto #811, with R5 updated for repair C. This is a separate proposal so the R5 merge-order patch isn't waiting idle for an integration order. Neither #773 nor #811 is changed.

Draft. Do not merge without the merge lane's decision. Base: #811's branch claude/card-pending-owner-and-cardholder-7q6vtf at aad8eac54.

Commits:

795b449aa: a normal merge of test(money): characterize card issuance and freeze requests sent twice (JIMMY-SUPPORT-CARD-RETRY-20261001) #773's head 51bf133f4. It brings in the 11 characterization cases, plus main 728204e2b's Mobile audit: accept node-forge GHSA-86w9-cpqp-85rv by id until it is fixed #838 files that test(money): characterize card issuance and freeze requests sent twice (JIMMY-SUPPORT-CARD-RETRY-20261001) #773 had merged.
fb7a27bc8: the R5 update, the same verified patch as fix(cards): pending card work survives a remount per signed-in owner; adopt only the exact duplicate cardholder (repairs A + C) #811 comment 5968508930 (result blob bb62b5b76).

What R5 now pins (after C):

Two first orders, Virtual and physical, for a child with no cardholder share one provider cardholder and one stripe_cardholders row, and no cardholder failure is logged.
In one millisecond, both card requests carry card-wallet-a-<ms>. The provider refuses the second as an idempotency error, and that order fails with money.couldNotIssueTheCard. This is the inherited key collision the owner kept open in 5964165675.
Re-ordering the refused type afterwards issues it.

Local results:

Run	Result
Combined tree, unchanged R5	1 of 11 fails (R5 only)
Combined tree, this R5	11/11 pass across 5 runs
Control: this R5 with main's `issuing.ts`	Fails on R5 only

eslint and tsc --noEmit are clean.

How it's used:

If the lane merges fix(cards): pending card work survives a remount per signed-in owner; adopt only the exact duplicate cardholder (repairs A + C) #811 then this: test(money): characterize card issuance and freeze requests sent twice (JIMMY-SUPPORT-CARD-RETRY-20261001) #773 is no longer needed separately.
If the lane merges test(money): characterize card issuance and freeze requests sent twice (JIMMY-SUPPORT-CARD-RETRY-20261001) #773 first: take only fb7a27bc8 onto fix(cards): pending card work survives a remount per signed-in owner; adopt only the exact duplicate cardholder (repairs A + C) #811.
Repair B is stacked on this branch (claude/card-attempt-identity-7q6vtf). B changes the card key and will flip R3/R5 again, so this R5 is the post-C, pre-B state.

No source change, provider call, credential, schema or production change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DXw2nu25BjyRfA6Fg3YiMS

Generated by Claude Code

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DXw2nu25BjyRfA6Fg3YiMS

… card key refuses one With ensureCardholder adopting the exact duplicate (repair C), two first orders for one child no longer fail at the cardholder step. They now meet the inherited card-<wallet>-<ms> idempotency key, so in one millisecond the provider refuses the second with the action's own text. Same verified patch as #811 comment 5968508930. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DXw2nu25BjyRfA6Fg3YiMS

vercel · 2026-10-03T11:50:25Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
bubaly	Ignored		Oct 3, 2026 4:12pm UTC

Mobile has been red on main since 2026-10-03 (from 79a0e11 on) on a new high advisory: braces <=3.0.3, stack-exhaustion denial of service on deeply nested patterns. 3.0.3 is the latest release, so there is no fix to take. braces arrives only through Expo's build tooling: expo -> @expo/cli -> @expo/metro-file-map -> micromatch. The owner asked for it to be allowlisted like node-forge (#838): one more entry in mobile/npm-audit-allowlist.json, by GHSA id for its own package, plus the CI comment. Any other high advisory, including a new one on braces, still fails. Checked against mobile/'s lockfile: with main's list the audit fails on GHSA-vfj7-8cjw-p6xm (as on main); with this list it passes, 2 allowlisted. The allowlist tests and the MAIN-F-C10 pin pass; the workflow and the allowlist parse. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TRY21ZKsFrfB3qtoP972A4 (cherry picked from commit 25718db)

…eason Review 5968590899 on #870: the reason named only expo -> @expo/cli -> @expo/metro-file-map -> micromatch. The lockfile also has expo -> @expo/metro -> metro-file-map@0.84.5 -> micromatch -> braces@3.0.3. The reason now names both, and says the lockfile shows these paths without showing whether braces reaches a device bundle. Reason text only; the accepted advisory, the package and the CI step are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TRY21ZKsFrfB3qtoP972A4 (cherry picked from commit cc6540c)

NewWorldVenture · 2026-10-03T12:21:52Z

CI on fb7a27bc8, and the Mobile fix ported in 644a90b86.

Passed: Typecheck · Lint · Test · Build; E2E; Database.
Failed: Mobile (Expo), at the dependency audit, on braces GHSA-vfj7-8cjw-p6xm (high).
Not this PR's: this PR changes only tests/money-card-retry-characterization.test.ts. Its base, fix(cards): pending card work survives a remount per signed-in owner; adopt only the exact duplicate cardholder (repairs A + C) #811's branch, predates main's allowlist. test(money): characterize card issuance and freeze requests sent twice (JIMMY-SUPPORT-CARD-RETRY-20261001) #773's merge brought in main's earlier node-forge entry (Mobile audit: accept node-forge GHSA-86w9-cpqp-85rv by id until it is fixed #838) but not braces.
Fix ported: the owner merged the braces exception into main as Mobile audit: accept braces GHSA-vfj7-8cjw-p6xm by id until it is fixed #870 (25718dbf1, cc6540cf7). I cherry-picked it unchanged as 4de9d0efb and 644a90b86.
- The allowlist file and the CI comment are byte-identical to main's 1421c7457, so this adds no new exception and changes nothing once the base carries it.
- Reproduced locally first: the audit failed on braces with this branch's allowlist and passes with main's, with node-forge and braces each listed by id.
- tests/npm-audit-allowlist.test.ts and the harness-config test pass 17/17.

Generated by Claude Code

NewWorldVenture · 2026-10-03T12:46:38Z

Hosted CI on 644a90b86: all green. Typecheck · Lint · Test · Build, E2E, Database and Mobile (Expo) all passed. Mobile is green with main's #870 braces entry ported unchanged (5969110043). Merge state is clean. This PR stays a draft.

Generated by Claude Code

(cherry picked from commit 8da1437)

NewWorldVenture · 2026-10-03T16:12:56Z

Head moved to edc7627fb: main's audit hardening ported unchanged.

Port: edc7627fb is main's 8da143742 (Fail closed on incomplete npm audit reports and command failures #887: fail closed on incomplete npm audit reports), cherry-picked unchanged. scripts/audit-npm-advisories.mjs and tests/npm-audit-allowlist.test.ts are now byte-identical to main 40bf5ff36.
Why: this branch carried Mobile audit: accept node-forge GHSA-86w9-cpqp-85rv by id until it is fixed #838's older copies through test(money): characterize card issuance and freeze requests sent twice (JIMMY-SUPPORT-CARD-RETRY-20261001) #773's merge. Without the port, the card stack would hit an add/add conflict on both files when it lands on main.
Local checks: npm-audit-allowlist, the harness-config test and the characterization tests pass 75/75. The hardened mobile audit passes at "high", with 2 allowlisted.
Up the stack: merged into fix(cards): one card order gives one card across tabs — attempt identity (repair B) #882 (35fa9b2d2) and fix(cards): refuse a stale card order and recover a committed card whose reply was lost (follow-up to #882) #903 (888d04d0e). The stack tip now merges into current main cleanly.
What this is not: no new advisory exception and no source change.

Generated by Claude Code

#773 (merged as 15da7b5) added tests/money-card-retry-characterization.test.ts, which characterizes card issuance BEFORE repair C. On #811 merged with main, "reproduces: virtual and physical ordered together for a child with no cardholder — one is refused at the cardholder step" fails, because #811's repair C makes that order succeed. No textual conflict. The next commit is R5, the verified follow-up already published on #876 (fb7a27b). Only R5 is carried: #876's npm/mobile audit commits are already in main through #887. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DXw2nu25BjyRfA6Fg3YiMS

NewWorldVenture · 2026-10-04T12:36:25Z

Support: this PR's content is now in #811 (6b09a2e87).

R5 (fb7a27bc8) was cherry-picked onto fix(cards): pending card work survives a remount per signed-in owner; adopt only the exact duplicate cardholder (repairs A + C) #811 after test(money): characterize card issuance and freeze requests sent twice (JIMMY-SUPPORT-CARD-RETRY-20261001) #773 merged to main.
The audit commits here are in main through Fail closed on incomplete npm audit reports and command failures #887.
Merged with fix(cards): pending card work survives a remount per signed-in owner; adopt only the exact duplicate cardholder (repairs A + C) #811's new head, this branch has no remaining diff.
It stays open only as the base of fix(cards): one card order gives one card across tabs — attempt identity (repair B) #882 (repair B). It will be closed once fix(cards): one card order gives one card across tabs — attempt identity (repair B) #882 is retargeted.

Generated by Claude Code

NewWorldVenture · 2026-10-04T13:42:21Z

Closing: this branch's content is now carried by #811 (R5 cherry-picked as 6b09a2e after #773 merged, per the note of 2026-10-04 12:36 UTC), and a merge with #811's head leaves no remaining diff. #882 is retargeted onto #811's branch so the card stack keeps its base.

Generated by Claude Code

#876 was closed (its content is carried by #811) and #882 retargeted onto #811's branch. The one conflict is tests/money-card-retry-characterization.test.ts, added on both sides: #811's copy (R5 cherry-picked as 6b09a2e) is byte-identical to #876's R5 (fb7a27b) that this branch already builds on, so this branch's version, R5 plus repair B's pinned changes, is kept unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DXw2nu25BjyRfA6Fg3YiMS

claude added 2 commits October 3, 2026 11:49

Merge #773 (51bf133) into #811's head for the proposed R5 integration

795b449

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DXw2nu25BjyRfA6Fg3YiMS

NewWorldVenture mentioned this pull request Oct 3, 2026

fix(cards): pending card work survives a remount per signed-in owner; adopt only the exact duplicate cardholder (repairs A + C) #811

Merged

claude added 2 commits October 3, 2026 11:55

Fail closed on incomplete npm audit reports and command failures

edc7627

(cherry picked from commit 8da1437)

NewWorldVenture mentioned this pull request Oct 3, 2026

EVIDENCE ONLY, do not merge: card stack (#811→#876→#882→#903) composed on main 40bf5ff36 #905

Closed

NewWorldVenture closed this Oct 4, 2026

Navigation Menu

Repository navigation

test(cards): proposed R5 integration of #773 onto #811 (post-repair-C) - #876

test(cards): proposed R5 integration of #773 onto #811 (post-repair-C)#876
NewWorldVenture wants to merge 5 commits into
claude/card-pending-owner-and-cardholder-7q6vtffrom
claude/card-r5-integration-7q6vtf

NewWorldVenture commented Oct 3, 2026

Uh oh!

vercel Bot commented Oct 3, 2026 •

edited

Loading

Uh oh!

NewWorldVenture commented Oct 3, 2026

Uh oh!

NewWorldVenture commented Oct 3, 2026

Uh oh!

NewWorldVenture commented Oct 3, 2026

Uh oh!

NewWorldVenture commented Oct 4, 2026

Uh oh!

NewWorldVenture commented Oct 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

NewWorldVenture commented Oct 3, 2026

Uh oh!

vercel Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NewWorldVenture commented Oct 3, 2026

Uh oh!

NewWorldVenture commented Oct 3, 2026

Uh oh!

NewWorldVenture commented Oct 3, 2026

Uh oh!

NewWorldVenture commented Oct 4, 2026

Uh oh!

NewWorldVenture commented Oct 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Oct 3, 2026 •

edited

Loading