FC-credentialed-dependency-resolved-before-guard.json

{
  "schema_version": 1,
  "id": "FC-credentialed-dependency-resolved-before-guard",
  "violated_contract": "A gate must answer the cases it can decide without an external dependency before resolving that dependency. Passing a credentialed client in argument position resolves it first, so an answer that needs no read still requires ambient credentials and fails where they are absent.",
  "canonical_prevention": "Resolve credentialed clients inside the branch that actually reads them, after the guards that can decide without one, and cover it with a test whose fake client raises on resolution so any path that resolves it needlessly fails.",
  "canonical_prevention_artifact": ["backend/tests/unit/test_paywall_reconnect_gate.py"],
  "evidence_prs": [11522],
  "scope_hints": ["backend/utils/subscription.py", "backend/database/_client.py", "backend/routers/desktop_*.py"],
  "status": "open"
}