Version. 0.1 · Date. 2026-08-07 · Author. Claude.ai (drafting) / Marvin Percival (approving).
Target. /Users/dunin7/loomworks, branch main.
Baseline. Post CR-2026-186. CC confirms at Step 0.
Companion to. inspection-briefs/loomworks-small-work-sweep-step-0-findings-v0_1.md §6.
Charter. Autonomous regime. Status. Ready for CC execution.
/auth is reachable in production. It refuses correctly — nothing is exposed — but it should not be reachable at all. What makes it not-small is that /auth is hardcoded as the real redirect target in 8+ files: session-expiry, sign-out, passkey and recovery-code flows.
Design decision, settled in advance: retarget every reference to the real sign-in path. No partial fix, no env-guard on the route alone. The defect is the hardcoding, not the route's existence — env-guarding leaves a reachable path with a misleading label and leaves the next person to find the same 8 references.
/auth in the surface — Step 1, reported before any edit. The sweep said 8+; treat that as a floor, not a count./auth's production reachability once nothing points at it.Every one of these paths is how a person gets back in when something has gone wrong — expired session, signed out, lost credential. A retarget that misses one leaves someone stranded at a route that no longer exists, in exactly the moment they cannot help themselves.
This is why Step 1 enumerates before anything is edited, and why §2.4's tests are per-flow rather than one generic redirect test. CC should treat an incomplete enumeration as the primary failure mode here, not a broken build.
Sign-in never requests email, never keys lookup by email. Nothing in this CR may introduce an email-keyed path while retargeting. If any existing reference routes to something email-keyed, halt and report — that is a separate and larger finding.
| Step | What | Mode |
|---|---|---|
| 0 | Pre-flight. | Auto |
| 1 | Enumerate every /auth reference. Report the full list before editing. | Auto |
| 2 | Retarget all. | Auto |
| 3 | Remove production reachability. | Auto |
| 4 | Per-flow tests: session expiry, sign-out, passkey, recovery code. | Auto |
| 5 | Surface sweep — lint, tsc, build, vitest. | Auto |
| A | Checkpoint. | Checkpoint |
| 6 | Tag cr-2026-187-b56-dev-signin-unreachable. Push. | Auto |
/auth remain outside development-only code./auth is not reachable in production.
Execute CR-2026-187 v0.1 at ~/Downloads/cr-2026-187-loomworks-b56-
dev-signin-unreachable-v0_1.md. Confirm the CR number first.
B-56: /auth is reachable in production and hardcoded as the redirect
target in 8+ files. Remedy is pre-decided — retarget everything, no
env-guard-only partial fix. Don't reopen it.
Step 1 enumerates every reference and reports the full list BEFORE any
edit. "8+" is a floor from the sweep, not a count.
The risk that matters: every one of these is how someone gets back in
when something has gone wrong. A missed reference strands a person at a
dead route at exactly the moment they can't help themselves. Treat an
incomplete enumeration as the primary failure mode — that's why Step 4's
tests are per-flow, not one generic redirect test.
HALT if any existing reference routes to something email-keyed. Sign-in
never requests email and never keys lookup by email; finding one would
be a separate and larger finding, not something to fix in passing.
DUNIN7 — Done In Seven LLC — Miami, Florida CR-2026-187 — B-56 dev sign-in unreachable — v0.1 — 2026-08-07