Build Log

MedinaCHF Clerk Fix, Then Closing Five Real Unenforced Hard Rules

August 17, 2026

Diagnosed and fixed a silent Clerk invitation failure back to its true root (deleteMember never cleaned up orphaned Clerk accounts), then, prompted by Zeb tracing that gap to a 2026-08-13 audit finding that was written down but never verified, spent the rest of the session closing five real instances of the same shape: a rule stated as mandatory with zero mechanical backing.

MedinaCHFClerkForgeKit OSGate EnforcementProduction Incident

real bugs found in MedinaCHF's own code (deleteMember, sendMemberInvitation)

distinct OS enforcement mechanisms shipped this session

real bugs found in Claude's own new code, caught by actually running tests

cross-repo audit of every flagged/deferred finding in ForgeKit's history

Timeline

Start

Zeb reported Clerk's invitation-send button failing with a generic 'Could not send the invitation' error and no visible cause anywhere

Continuing from an already-fixed production outage (schema pushed to the wrong Neon branch) in the same conversation — this was a second, unrelated issue on the same page

Root cause 1

Traced the silent failure to Clerk's real error code (form_identifier_exists) by adding diagnostic logging and redeploying — the email already had a Clerk account from a previously deleted test member

deleteMember only removed database rows; it never called Clerk to delete the linked user, so the account was orphaned and silently blocked re-invitation

The real question

Zeb asked how this was missed — traced it to an Adversarial Build Audit Gate that DID catch the exact bug on 2026-08-13, three days before it caused a real incident, but the finding was written into a code comment admitting it was an unverified guess and shipped anyway

Zeb's correction, verbatim: 'this is another case of being way too paranoid of scope creep and leaving things unfinished... if you know that something isn't safe or is incomplete, it requires a hard verification from me before we shelve it or just flag it'

Rule fixed at the source

Corrected gates-specialized.md's Adversarial Build Audit Gate: a finding surfacing unverified/unsafe behavior is closed only by fixing it in-session or by Zeb explicitly accepting the risk after being told plainly what it is — never by a comment, a nextItems entry, or a 'safe fallback' argument

Recorded as a paired Anvil/Strike

Scope question

Zeb asked how many other things are 'flagged' as potential issues across all of ForgeKit — dispatched a full cross-repo audit (242 session retros + source-tree grep)

Found 5 items sharing the same dangerous shape; one (MedinaCHF's Clerk webhook) was checked live against Clerk's dashboard and Vercel and downgraded from 'likely broken' to 'configured but unproven'

Concurrency incident

Zeb connected this to a real, separate recurring failure: concurrency.md's worktree rule had been violated 3 times despite being a stated hard rule since 2026-07-31, once permanently losing a real commit

Built a PreToolUse mechanical backstop (deny on real HEAD-drift collisions, ask on a fresh other-session heartbeat) plus an orient-time check in ignition-core.md, after first questioning and confirming worktrees themselves already work correctly out of the box — the gap was never having a session actually start in one

The pattern named directly

Zeb: 'isn't this just going to be the same thing. it's written down but never enforced' — asked for a second, broader audit of every hard-stop rule across the whole repo

Found 4 more real instances: Session-Close Gate, Adversarial Build Audit Gate (already known), Deploy Gate's live-verification claim, and crucible:wrap — plus confirmed Anvil Check was already correctly enforced, correcting the audit's own initial miscount

Closing the list

Built real enforcement for crucible:wrap (hard-fail), Session-Close Gate (non-blocking commit-time reminder, after a hard-block design was drafted and rejected in-session), and Deploy Gate's live-URL check (wired into all 13 deploy:* commands)

Deferred Adversarial Build Audit Gate itself, with a written reason, since its real trigger is genuinely compound and harder to detect reliably than a boolean

Stop the pattern, not just this list

Built a drift-prevention mechanism in engine-guard.mjs: scans every rule file for hard-stop phrases, diffs against a reviewed baseline and an explicit prose-only-rules registry, warns on anything genuinely new

Proven live before shipping — it correctly caught its own crucible_wrap line at a shifted position and needed reclassifying as now-enforced, not left flagged

What shipped

products/medinaCHF/lib/actions/member-management.ts — deleteMember now deletes linked Clerk user(s) before the DB delete; sendMemberInvitation logs the real Clerk error instead of silently swallowing it

.claude/rules/gates-specialized.md — Adversarial Build Audit Gate: a known-unsafe/unverified finding can no longer be closed by a comment, a nextItems entry, or a 'safe fallback' argument — only by fixing it or Zeb explicitly accepting the named risk

.claude/hooks/lib/concurrency.mjs + wiring into gate-dispatch.mjs/gate-transcript-capture.mjs — mechanical PreToolUse backstop for concurrent-session HEAD-drift collisions

forgekit-os/scripts/check-concurrent-session.mjs + ignition-core.md §1 — orient-time concurrency check, the actual right-layer fix per Zeb's correction (catch it before touching anything, not after)

forgekit-os/scripts/build-session.mjs — crucible:wrap promoted from warn-only to a hard fail under canonical-v1, with 5 new tests and 6 existing-test fixture fixes

.claude/hooks/lib/commit-checks.mjs + pre-commit-check.mjs — Session-Close Gate visibility reminder (non-blocking; a hard-block version was drafted and rejected after recognizing it would block every intermediate WIP commit)

forgekit-os/scripts/verify-deploy.mjs + deploy-targets.config.mjs + package.json — real post-deploy live-URL check chained onto every deploy:* command

forgekit-os/scripts/engine-guard.mjs + hard-rule-baseline.json + prose-only-rules.config.mjs — drift-prevention check for any NEW unenforced hard-stop rule appearing in the future

forgekit-os/sessions/medinachf-flagged-findings-audit-2026-08-17.json — the cross-repo flagged-findings inventory session, already closed with its own retro

“isn't this just going to be the same thing. it's written down but never enforced”
— Zeb, on the concurrency fix, extending the same challenge to every hard rule in the repo