Audit Remediation — Problem Spaces & Solution Architecture (2026-07-11)
Status: Archived
The 2026-07-11 whole-app audit produced ~130 findings across 16 semantic blocks (docs/audits/blocks/*). This directory reorganizes those findings into problem spaces — thematic clusters that share a root cause, a design approach, and a verification strategy — and composes a research-based solution design for each. The master sequencing lives in ../implementation-roadmap-2026-07.md.
Why re-cluster instead of fixing block-by-block: several of the sharpest defects appear in 3–4 blocks at once with one root cause (e.g. the anon-EXECUTE leak surfaced in B5/B6/B7/B8; the match-finalize gap in B3/B4/U4). Fixing per block would patch symptoms 4× and miss the shared fix. Problem spaces collapse each root cause into one designed solution.
The eleven problem spaces
| PS | Space | Root theme | Blocks it draws from | Doc |
|---|---|---|---|---|
| PS1 | Access control & DB hardening | SECDEF/RLS/GRANT are inconsistently applied; Supabase default-ACL quirk defeats REVOKE FROM PUBLIC | B7, B8, B1, B6, B5 | ps1-access-control.md |
| PS2 | Payments & settlement integrity | the settle-before-play gate + hold lifecycle have bypasses and signal gaps | B3, B4, U3 | ps2-payments.md |
| PS3 | Session & RSVP lifecycle | waitlist promotion, capacity races, status machine, public visibility | B2, U3 | ps3-sessions-rsvp.md |
| PS4 | Match & rating integrity | finalize/swap have no status gate; disputed state machine is dead | B4, U4 | ps4-matches-rating.md |
| PS5 | Dues & attendance | 5 divergent "overdue" defs; waive/partial holes; strike resurrection | B5, U8 | ps5-dues-attendance.md |
| PS6 | Clubs & membership lifecycle | sole-owner lockout, ghost members, dead join-request approval | B1, U2 | ps6-clubs-membership.md |
| PS7 | Identity, account & consent | profiles PII leak + column-forge, incomplete deletion, OAuth, consent | B8, U7 | ps7-identity-account.md |
| PS8 | Notification & signal surfacing | push-tap dead-ends, no preferences UI, admin-count drift (model itself shipped) | U1, U7 | ps8-notifications.md |
| PS9 | Venues & discovery | badge honesty, funnel leak, corrections RLS, deep-data dormant | B6, U6 | ps9-venues-discovery.md |
| PS10 | Records & analytics UX | graphics gaps, sparkline/leaderboard bugs, zero-state, tap-to-profile | U5 | ps10-records-ux.md |
| PS11 | Platform guardrails | no regression guard for the classes of bug the audit found | B7, cross-cutting | ps11-guardrails.md |
| PS12 | Engineering streamline (final phase, owner directive 2026-07-11) | after all fixes land + E2E-verified: correct architecture, SoC + single-source-of-truth, prefer-libraries-over-custom (no bespoke where a mature lib fits), comprehensive test suites for a robust pre-prod app | cross-cutting | ps12-engineering-streamline.md |
Verification discipline (owner directive, 2026-07-11)
Two standing rules layered on top of the slice contract below:
- Every slice is E2E-verified at its end — not just
yarn check. Before a slice is marked done, prove the flagged problem is actually fixed end-to-end: a synthetic/seeded scenario exercising the real path (RPC + RLS + client), an on-device/OTA check for UI slices, or a Maestro flow where device-level proof is the requirement. The verification is stated in the slice and its evidence recorded. - PS12 runs last. Once every problem space's slices are shipped AND E2E-confirmed, PS12 streamlines the whole app from an engineering standpoint: enforce the hexagonal architecture + separation of concerns, collapse any remaining duplicate implementations to a single source of truth, replace custom code with mature libraries where one fits (per the prefer-libraries-over-custom rule), and backfill test coverage so the pre-production app is robust. PS12 is authored during synthesis (it depends on the final shape of every other space) — not a reflexive rewrite.
Solution-doc contract
Each psN-*.md follows the same structure so the roadmap can consume them uniformly:
- Problem statement — the consolidated defect(s), each tagged with its source block finding + severity. One coherent narrative, not a list of symptoms.
- Research — how this class of problem is solved correctly: concrete references (Postgres/Supabase RLS patterns, column-privilege vs policy-predicate, advisory-lock idioms, PortOne v2 verify flow, notification preference UX from real apps, etc.), and what actually runs in our codebase today (import/trigger chains, not obvious-named files). Cross-validated.
- Solution design — the canonical fix, grounded in the research and repo canon (SECDEF +
search_path=''+ REVOKE FROM PUBLIC, anon + GRANT; explicit per-table GRANT;signals_emitfor events; no PII in JSONB; Tamagui-only + bounded variants for UI). Names exact functions/tables/ policies/components. - Slices — the work broken into shippable units, each with: type (migration / client-OTA / edge-fn), blast radius, verification (psql probe / synthetic test / yarn check), and dependency on other slices.
Status
Solution docs are authored by the remediation-design pass (2026-07-11). The prior triage lives in ../implementation-plan-2026-07-audit.md (superseded by the roadmap once solution docs land) and the canonical server fixes in ../wiring-plans-2026-07-backend.md (the PS docs cite it rather than repeat).