MedinaCHF Clerk Fix, Then Closing Five Real Unenforced Hard Rules

Timeline

1. 1

   Start

   Zeb reported Clerk's invitation-send button failing with a generic 'Could not send the invitation' error and no visible cause anywhere

   Continuing from an already-fixed production outage (schema pushed to the wrong Neon branch) in the same conversation — this was a second, unrelated issue on the same page

2. 2

   Root cause 1

   Traced the silent failure to Clerk's real error code (form_identifier_exists) by adding diagnostic logging and redeploying — the email already had a Clerk account from a previously deleted test member

   deleteMember only removed database rows; it never called Clerk to delete the linked user, so the account was orphaned and silently blocked re-invitation

3. 3

   The real question

   Zeb asked how this was missed — traced it to an Adversarial Build Audit Gate that DID catch the exact bug on 2026-08-13, three days before it caused a real incident, but the finding was written into a code comment admitting it was an unverified guess and shipped anyway

   Zeb's correction, verbatim: 'this is another case of being way too paranoid of scope creep and leaving things unfinished... if you know that something isn't safe or is incomplete, it requires a hard verification from me before we shelve it or just flag it'

4. 4

   Rule fixed at the source

   Corrected gates-specialized.md's Adversarial Build Audit Gate: a finding surfacing unverified/unsafe behavior is closed only by fixing it in-session or by Zeb explicitly accepting the risk after being told plainly what it is — never by a comment, a nextItems entry, or a 'safe fallback' argument

   Recorded as a paired Anvil/Strike

5. 5

   Scope question

   Zeb asked how many other things are 'flagged' as potential issues across all of ForgeKit — dispatched a full cross-repo audit (242 session retros + source-tree grep)

   Found 5 items sharing the same dangerous shape; one (MedinaCHF's Clerk webhook) was checked live against Clerk's dashboard and Vercel and downgraded from 'likely broken' to 'configured but unproven'

6. 6

   Concurrency incident

   Zeb connected this to a real, separate recurring failure: concurrency.md's worktree rule had been violated 3 times despite being a stated hard rule since 2026-07-31, once permanently losing a real commit

   Built a PreToolUse mechanical backstop (deny on real HEAD-drift collisions, ask on a fresh other-session heartbeat) plus an orient-time check in ignition-core.md, after first questioning and confirming worktrees themselves already work correctly out of the box — the gap was never having a session actually start in one

7. 7

   The pattern named directly

   Zeb: 'isn't this just going to be the same thing. it's written down but never enforced' — asked for a second, broader audit of every hard-stop rule across the whole repo

   Found 4 more real instances: Session-Close Gate, Adversarial Build Audit Gate (already known), Deploy Gate's live-verification claim, and crucible:wrap — plus confirmed Anvil Check was already correctly enforced, correcting the audit's own initial miscount

8. 8

   Closing the list

   Built real enforcement for crucible:wrap (hard-fail), Session-Close Gate (non-blocking commit-time reminder, after a hard-block design was drafted and rejected in-session), and Deploy Gate's live-URL check (wired into all 13 deploy:* commands)

   Deferred Adversarial Build Audit Gate itself, with a written reason, since its real trigger is genuinely compound and harder to detect reliably than a boolean

9. 9

   Stop the pattern, not just this list

   Built a drift-prevention mechanism in engine-guard.mjs: scans every rule file for hard-stop phrases, diffs against a reviewed baseline and an explicit prose-only-rules registry, warns on anything genuinely new

   Proven live before shipping — it correctly caught its own crucible_wrap line at a shifted position and needed reclassifying as now-enforced, not left flagged

What shipped

• products/medinaCHF/lib/actions/member-management.ts — deleteMember now deletes linked Clerk user(s) before the DB delete; sendMemberInvitation logs the real Clerk error instead of silently swallowing it

• .claude/rules/gates-specialized.md — Adversarial Build Audit Gate: a known-unsafe/unverified finding can no longer be closed by a comment, a nextItems entry, or a 'safe fallback' argument — only by fixing it or Zeb explicitly accepting the named risk

• .claude/hooks/lib/concurrency.mjs + wiring into gate-dispatch.mjs/gate-transcript-capture.mjs — mechanical PreToolUse backstop for concurrent-session HEAD-drift collisions

• forgekit-os/scripts/check-concurrent-session.mjs + ignition-core.md §1 — orient-time concurrency check, the actual right-layer fix per Zeb's correction (catch it before touching anything, not after)

• forgekit-os/scripts/build-session.mjs — crucible:wrap promoted from warn-only to a hard fail under canonical-v1, with 5 new tests and 6 existing-test fixture fixes

• .claude/hooks/lib/commit-checks.mjs + pre-commit-check.mjs — Session-Close Gate visibility reminder (non-blocking; a hard-block version was drafted and rejected after recognizing it would block every intermediate WIP commit)

• forgekit-os/scripts/verify-deploy.mjs + deploy-targets.config.mjs + package.json — real post-deploy live-URL check chained onto every deploy:* command

• forgekit-os/scripts/engine-guard.mjs + hard-rule-baseline.json + prose-only-rules.config.mjs — drift-prevention check for any NEW unenforced hard-stop rule appearing in the future

• forgekit-os/sessions/medinachf-flagged-findings-audit-2026-08-17.json — the cross-repo flagged-findings inventory session, already closed with its own retro