mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
91a605de2a
Both consent gaps had the same shape: a module resolved a live provider and nothing connected that to "check a receipt first". Behavioural tests cover the two surfaces; this covers the class. A module importing resolveProvider, resolveProviderChain or resolveProviderForTest holds something it can call generateCompletion on, so it must also import a consent helper — or sit on an allowlist with a written reason. Four entries today, all of them probes or the credential connection test, none of which send health data. The guard is an import-level tripwire and its header says so: it cannot show the gate is reached on every path, called before the egress, or passed the right surface. What it does is stop a new ungated call site landing without a reviewer seeing this file change.