Automated review (CRITICAL): route registered above requireAuth, identity
fields trusted from the body. Two fix options specified; must land before
any pilot. Companion to SEC-C6.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Automated review flagged POST /api/bills trusting overrides[].approvedByUserId
from the client; verify-pin result never bound to the commit. Server-side
approval-token fix specified; must land before any pilot (Phase 1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New docs/14-SPEC-HQ-CONSOLE.md: internal ops console (apps/hq) for the
~300 Classic clients - quotations/proforma/invoices in minutes with Gmail
send, recurring billing + reminders, AMC, per-client AWS cost, interaction
log; replaces the internal Oracle APEX app. Doc-11 HQ Console started early.
Also: HQ workstream in 04-ROADMAP, D15 in 06-DECISIONS, cross-refs in
doc 11 + STATUS. First commit of the docs baseline (00-17).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Thomas Joise