# Claims review — 0.2.51

- base: v0.2.50
- head: c5e6856
- surface: sha256:5e19438da257251566a53fd75faa10e2d42f196b11e3f60fd1bf46a6cf96f8e8
- verdict: pass
- reviewer: Claude. The diff from v0.2.50 touches four claim surfaces: `README.md`,
  `CHANGELOG.md`, `LIMITATIONS.md` and `LIMITATIONS.tr.md`. Each sentence that
  says what `conarium --demo` does was read against the mechanism and against a
  test that was seen failing when the mechanism was removed.

  - "An allowed table returns rows with email and card values masked before the
    rows leave the gate." The masking is the gate's own second pass over the
    result rows, not code in the sample connector. `C2` asserts that none of the
    raw sample values appears in the response, and it failed when the mask
    assignment in `src/governance.ts` was removed. Emptying `maskColumns` in the
    demo policy did not make it fail, because the gate also masks by column name
    and by value pattern; that is the behaviour the sentence describes.
  - "a denied table is refused." `C3` asserts the refusal and that the sample
    connector's query counter stays at zero. It failed when `public.secrets` was
    moved onto the allow list. Emptying `denyTables` alone did not make it fail:
    a table that is not on the allow list is refused by default.
  - "the row cap is applied." `C4`, which failed with the cap raised above the
    sample table's size.
  - "allowed and refused calls are recorded on a signed chain." `C5` verifies the
    chain left by `--keep` with the repository's own verifier.
  - "`type: "demo"` in a config file is refused." `C9`, which failed with the
    refusal removed from `src/config.ts`.
  - "The sample connector answers `SELECT <columns | *> FROM <sample table>` and
    returns the columns the statement named and no others; `WHERE`, `JOIN`,
    expressions and aliases are refused rather than ignored." As first written
    the connector matched the table name anywhere in the statement and returned
    every sample column, so a statement naming one column got the others back
    too, and a `WHERE` clause was dropped without a word. That was corrected
    before this record, in `5b731e0`, and four tests hold it; two of them failed
    under mutation.
  - "sample rows, not a database" and "None of the shipped connectors is
    exercised" state what the mode does not show. They are limits, and they are
    in `LIMITATIONS.md` and its Turkish counterpart under the same key.

  The in-process tests call `bootDemo()` and never reach `main()`, so a line
  printed to stdout there, or an update check on the demo path, would have
  passed them. `test/demo_cli.mjs` runs the built entry as a process and failed
  on both when each was introduced. No claim surface says the mode is offline;
  the check exists so that the stdio contract holds, not to support a sentence.

  The first cut also ran `main()` only when `process.argv[1]` was the entry file,
  which is false when the entry is imported by `bin/conarium-docker-entry.mjs` or
  reached through an npm bin link: the server never started. `test/docker_entry.mjs`
  caught it, and `c5e6856` restores an entry that always runs. No claim surface
  changed with it, and the surface digest above is the same before and after.

  The README byline gains one sentence linking the VERAX body repository. It
  says where another repository is and asserts nothing about what this tool
  does.

  The rest of the release is version fields (`package.json`, `server.json`,
  `package-lock.json`). None of those files is a claim surface.

## Findings

none