Skip to content

Integrity Audit Closure — last1.app Coordination Model

Date: 2026-09-09
Tag: integrity-audit-closed-2026-09-09
Scope: WIN / VetClaims TEST program coordination on sovereign prod (https://last1.app, DB on R940, last1.id on auth VM)

The model's integrity is now systematically proven on the deployed system, not assumed. Each finding was fixed (or confirmed), covered by both-sides unit tests, and verified on wired prod before this closeout.

Summary

Phase Finding Fix Wired-prod proof
C1 Recipient could attest without identity binding; unverified veterans could write assertVeteranWorkSession choke point: strict beneficiary link → Last1 ID → veteran_verified → scope → F5 no-conflict scripts/c1-wired-prod-gate-verify.ts
H1 Legacy I1a write path bypassed Ω ledger I1a write path retired (410); all output state via Ω append only scripts/h1-wired-prod-verify.ts
H2 DD-214 approval integrity gaps (self-approval, no submission, dishonest method) last1.id guards + audit; last1.app defense-in-depth and honest provenance UX scripts/h2-wired-prod-verify.ts
H3 BSL upload not identity-bound at service layer; Ω substrate hardening assertBslUploadIdentityBinding on BSL upload; Ω append-only rules + PHI guard scripts/h3-wired-prod-verify.ts

Unblocks: Tony/SOP external walkthrough (loop1-second-real-external-veteran-proof in Muster). Ryan composed E2E PASS 2026-09-09 (below).

Composed E2E PASS — 2026-09-09 (Ryan, wired prod)

Ryan completed the full browser walkthrough on sovereign prod (curryrg@gmail.com / WIN org admin / VetClaims TEST) per INTEGRITY_AUDIT_E2E_WALKTHROUGH.md. All four gates compose in one legitimate verified-veteran journey — not just in isolation scripts.

Step Gate Proof
DD-214 submit → org approve H2 Org-attested verification; no self-approve path
Unverified gate blocks / verified unlocks program work C1 Member actions bound to strict beneficiary link + veteran_verified
Output submit + org ladder → two-source close H1 Ω-only transitions; no I1a bypass
DRI loop open → veteran confirm → BSL upload → org review → VERIFIED H3 Loop f6c68f45-2964-484c-8a00-8f8eacd832fc closed on wired prod

Composed-flow fixes landed during the walkthrough (deployed to .104 before E2E close):

  1. Coordination loops list — batched ledger fetch; org dashboard no longer 500'd with live denominator stats but empty table.
  2. Confirm delivery — coordinationPayloadAllowlist extended for C1 actor fields; deliverer attestation returns 400 not opaque 500.
  3. Member BSL post-upload UX — veteran loop card shows submitted filename + pending-review state; upload affordance hides while review pending.

Parked friction (real, non-integrity, deferred to Muster backlog): duplicate BSL uploads per loop; opaque loop_terminal error on second approve; no automated BSL document-recency check (org Reject is the Phase 1 path; ties to Filing stages / feedback-driven watch-item).

C1 — Recipient identity binding + hard verification gate

Problem: Org-side or loosely linked sessions could produce recipient attestations; unverified veterans could reach program actions.

Fix (last1.app): - resolveStrictLinkedBeneficiary — no email fallback; session user_id must match beneficiary row - assertVeteranWorkSession — single choke for all veteran-work mutators (outputs, loops, BSL, milestones) - Hard gate: organizationRequiresMemberVeteranVerification → memberVeteranWorkAllowed(status) or 403 - F5: assertDistinctOutputActorRole / loop actor gates block same identity as deliverer + recipient

Wired prod: Org admin blocked (RECIPIENT_BENEFICIARY_REQUIRED); unverified veteran blocked; verified veteran passes on distinct deliverer/recipient identities.

H1 — I1a retired; Ω-only output state

Problem: Legacy I1a attestation writes could mutate output state outside the hash-chained Ω ledger.

Fix (last1.app): - I1a write endpoints return 410 / I1A_DEPRECATED_USE_OMEGA - All output transitions via appendOutputStateEvent → program_coordination_output_state_events

Wired prod: I1a route 410; Ω append succeeds; state recomputable from ledger.

H2 — Verification approval integrity

Problem: Org could approve DD-214 without real submission, self-approve, or record misleading verification method.

Fix (last1.id + last1.app): - Real submission required (document ref + retrievability at decide time) - Self-approval blocked (reviewer_identity_id !== subject identity_id) - Honest method: verification_method=dd214, verification_independence=org_attested - Audit log on every decide (admin_audit_logs, dd214_review_decided)

Wired prod: Bogus review 409; self-approval 403; legitimate org approval records method + audit row.

H3 — BSL identity binding + Ω substrate

Problem: BSL upload relied on route gate only; service layer accepted arbitrary beneficiaryId. Ω ledger lacked Λ-parity append-only rules in migration (now hardened).

Fix (last1.app): - createBenefitSummaryLetterReview({ actorUserId, loopId, ... }) calls assertBslUploadIdentityBinding (C1 stack + loop beneficiary/org/outcome checks) - Migration 20260909120000_h3_omega_ledger_hardening.sql: protect rules on program_coordination_output_state_events - App: assertNoPhiInOmegaPayload on every Ω append; verifyOutputStateHashChain for verification scripts

Wired prod: Org admin blocked on BSL; verified veteran uploads own BSL; Ω UPDATE blocked; PHI key scan 0; hash chains intact.

Operational note — break-glass and DB access control

Ω append-only is enforced at two layers: 1. Application — only appendOutputStateEvent inserts; no update/delete APIs 2. Database — PostgreSQL rules protect_program_coordination_output_state_events_no_{update,delete} (DO INSTEAD NOTHING)

A DB superuser break-glass path still exists (drop rule → corrective SQL → recreate rule). This is necessary for ops (migration repair, test-account reset, incident response). It is not a product gap: the ultimate integrity boundary for ledger tampering is who holds superuser credentials on the coordination DB, not app-layer optimism alone.

Document any break-glass use in ops notes; prefer append-only corrections (new events) in production veteran data.

Repos and tags

Repo Tag Primary artifacts
last1.app integrity-audit-closed-2026-09-09 C1/H1/H3 gates, wired verify scripts, Ω migration
last1.id integrity-audit-closed-2026-09-09 H2 decide guards, audit, VA/DD-214 clients
lastvet-gates integrity-audit-closed-2026-09-09 This closeout + E2E walkthrough
muster integrity-audit-closed-2026-09-09 Tracker item last1-app-integrity-audit-closed
  • INTEGRITY_AUDIT_E2E_WALKTHROUGH.md — Ryan composed E2E (all four gates)
  • docs/architecture/LOOP1_REAL_VETERAN_JOURNEY_CORE.md — prior Loop #1 browser milestone (Λ placement loop)
  • docs/architecture/LOOP1_COORDINATION_ARCHITECTURE.md — proof substrate / PHI-free ledger design law