Make the child chore refusal test detect missing manager authorization

[NewWorldVenture]

The child-create refusal test could pass when manager authorization was bypassed because its member-sibling assignee was absent from the family fixture. This six-line test-only change supplies that valid same-family sibling, asserts the parent/guardian-specific denial, and compares both chore and assignment rows against snapshots to prove no writes.

Only tests/chore-manager-only-writes.test.ts changes, stacked on exact #878 2e9dc8bd65a38736785d7dbbe771d7657cbc2ba1. All original cases and guards remain. Product source, the other three #878 files, #881's fixtures, and #874's Calendar scope are byte-identical to the selected base. Ownership claim: #771 (comment). Fresh bounded #878/#771 reads found no actual conflict on this owned path.

Validation on Node 24.21.0: all 166 cases across the original four #878 files pass with identical case names and zero skips; scoped ESLint has zero warnings; full non-incremental TypeScript checking passes. Existing dependencies were reused after exact package-lock package-record comparison. Auth/server fixtures remain mocked; child process environment is restricted to essential variables and network transports are refused.

Matched negative control, disposable local checkout only: keep both refuseUnlessManager(ctx.active.role) call sites and all membership guards intact, but ignore only the create-action refusal. All ten original manager-test cases pass: the child gets a membership rejection instead. With the strengthened case, nine pass and exactly that child-create case fails because the same bypass now mints a chore and assignment. Both snapshots grow from one row to two. The bypass and trace instrumentation were restored byte-for-byte and are not included in the published tree.

#878 CI run 37122188387 has completed with Web and Mobile failure, while E2E and Database pass. Known remaining Meals product failures from its baseline (raw stored recipe href and missing meal-planner catalogue keys) are unchanged and remain in the Meals owner's scope. This is not full-suite/full-CI, backend/RLS, provider, browser, production or vulnerability closure. No ledger, exception, config, schema or production changes, merge or deployment.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
bubaly	Ignored		Oct 3, 2026 1:17pm UTC

[NewWorldVenture]

Independent efficacy review completed on exact head 8e1f3dc2499b7895123ae8c169c39aa7eed74a9f and current main 9c9350fb6f86c6c93e90c959eaac76c98d01c2d3 with the six-line patch applied.

Both 10-case suites pass. Temporarily removing only createChoreAction's manager authorization check makes the child-denial test fail on both trees: the result becomes { ok: true }. Seeding the same-family sibling prevents a missing-member refusal from masking that authorization regression; the error and row snapshots also pin the intended boundary. Mutations were restored; all data was synthetic.

This historical non-main candidate has failed Web/Mobile gates, despite passing Database/E2E. The patch is now transposed onto current main as draft #899 at 5f9e226319030d48d83a5067fd8a824788c16d47, with root's fresh 10-case and targeted lint passes. Full exact-head hosted checks are still pending; no broader workflow or production-readiness claim is made.