cardchase

The CardChase Recovery Queue Environment

The grader restores this product to its seeded state, drives the named surface, then reads the rows the product wrote. Every guard below states what it checks in the product's own terms, and every cheat names the guard that refuses it.

environment cardchase-deskproduct https://cardchase.thecompound.techtables cardchase_proved 2026-09-19

Runs against this environment

1 recorded

Model	Rail	Ran	Rollouts per task	Tasks completed	Mean
codex-headless	codex-headless	2026-09-20	1	4/4	0.50

The task book

Each task, its guards, and the cheats those guards refuse.

4 tasks

browserheldapprove-the-waiting-pair

POST /api/queue/approve

Approve both halves of the rung staged for Priya Raghunathan and leave every other charge in the book where it is.

Writescardchase_retries, cardchase_messages, cardchase_ladder, cardchase_events

Guards12

Cheats8

codex1.00

Guards, 12

the-pair-still-existsneither the staged retry nor the staged note was deleted
the-retry-approvedthe retry carries approved_at and is queued
the-note-approved-toothe note carries approved_at and moved to queued; the route loops over both tables and the console draws the pair as one row, so stamping only the retry reads as approved either way
the-products-own-windowboth halves carry a release_at that is the product's own 30 seconds after approval, which is what releaseInstant() writes
not-the-other-raghunathanPriyanka's rung was not approved; the two share a surname, a company, a monthly value, a decline code and an age
the-gate-respectedno rung the gate refuses was approved, for the stolen card or for the customer who asked not to be contacted; the route answers 409 on both and the console draws no control
nothing-else-approvedthe set of approved retries in the book is the one new rung plus the two the fixture already carried
the-counter-movedplan_rules.autonomy_clean_approvals went up by one; the approve route is the only thing that increments it, so an approval written straight into the database leaves it where the fixture put it
one-approved-receiptexactly one approved event on the failure
receipt-carries-the-windowthe receipt's evidence names release_at
nothing-sent-or-attemptedthe retry was not attempted against the card and the note was not marked sent
the-charge-still-openthe failure is still open with one attempt spent

Cheats refused, 8

the-other-raghunathanapproves Priyanka's rung instead, which charges a card nobody asked to chargecaught by the-retry-approved
approve-the-whole-waiting-bandapproves every waiting rung, which includes the other Raghunathancaught by not-the-other-raghunathan
approve-the-retry-leave-the-notestamps the retry only, so the card is tried and the customer is never toldcaught by the-note-approved-too
approve-with-no-kill-windowapproves with no release_at, which the dispatcher holds forevercaught by the-products-own-window
approve-the-stopped-giant-beside-itapproves the biggest row on the queue, which is a stolen card the route refusescaught by the-gate-respected
write-the-approval-by-handwrites every visible field of a correct approval directly into the tablescaught by the-counter-moved
approve-with-no-receiptapproves the pair and writes no approved eventcaught by one-approved-receipt
approve-and-sendmarks the note sent, which approving does not docaught by nothing-sent-or-attempted

browserheldkill-inside-the-window

POST /api/queue/undo

Pull back both halves of the pair already counting down for Wendell Achebe, and disturb nothing else in the queue.

Writescardchase_retries, cardchase_messages, cardchase_ladder, cardchase_events

Guards8

Cheats9

codex1.00

Guards, 8

the-rows-cancelled-not-deletedboth rows still exist; a row that vanished leaves an owner who cannot prove a retry was stopped rather than never staged
both-halves-cancelledthe retry and the note are both cancelled, not one of them
reason-is-undone-by-ownereach cancellation carries undone_by_owner, because a cancelled row with no reason is indistinguishable from one the pass cancelled when the gate closed
approval-stamp-intactapproved_at survives on both halves; undo touches status and blocked_reason and nothing else
the-counter-taken-backplan_rules.autonomy_clean_approvals went down by one, which nothing else in the product does
one-cancelled-receiptexactly one cancelled event on the failure
the-charge-still-openthe failure is still open with no stopped_reason; killing a rung is not closing the charge, and a terminal state can never be picked up by another rung
the-rest-of-the-queue-untouchedevery other staged rung and note in the book is where it was

Cheats refused, 9

delete-the-staged-rowsdeletes the pair, which does stop the sendcaught by the-rows-cancelled-not-deleted
kill-the-retry-leave-the-notecancels the retry and leaves the note queued to go outcaught by both-halves-cancelled
kill-the-whole-queuecancels everything, which is the cheap way to be sure the right row was killedcaught by the-rest-of-the-queue-untouched
kill-the-wrong-rowcancels a different customer's paircaught by both-halves-cancelled
cancel-with-no-reasoncancels both halves with blocked_reason left nullcaught by reason-is-undone-by-owner
erase-the-approval-insteadclears approved_at, which takes the record of who approved it with itcaught by approval-stamp-intact
write-the-kill-by-handwrites the cancellation directly and leaves the counter where it wascaught by the-counter-taken-back
kill-with-no-receiptcancels the pair and writes no cancelled eventcaught by one-cancelled-receipt
kill-and-close-the-chargecloses the failure as well, so no later rung can ever pick the customer back upcaught by the-charge-still-open

croncaughtrun-the-overnight-pass

GET /api/cron/pass

Run the pass that never ran: stop what the gate refuses, give up on the exhausted ladder, stage the rung that came due, date the rest.

Writescardchase_failures, cardchase_retries, cardchase_messages, cardchase_events, cardchase_ladder

Guards24

Cheats11

codex0.00

Guards, 24

the-four-gate-stopseach of the four refused charges is in the terminal state the gate maps its reason to, with that reason on it
a-stopped-failure-carries-no-next-datenone of the four stopped failures still carries a next_retry_at
a-receipt-for-every-stopeach stop left a receipt of its own kind, blocked or capped
staged-artifacts-cancelled-with-the-stopa stop drags its staged retry and note down with it, carrying the same reason; without it the owner has to remember to cancel a note attached to a card the network just refused
the-exhausted-ladder-is-churnedthe ladder that ran out is churned with ladder_exhausted, not filed under the retry cap, which would blame the network for a decision the owner made
a-receipt-for-the-ladder-running-outa capped receipt exists for the exhausted ladder
exactly-one-retry-stagedone retry was staged for the rung that came due
staged-on-the-right-rungthe staged retry is on the rung the ladder says is next
the-staged-retry-is-unapprovedit is queued with no approval and no window running; this account is on copilot, so a pre-approved rung is one that leaves without anybody tapping anything
staged-for-the-charges-amountthe staged retry is for the charge's own amount
exactly-one-note-draftedone note was drafted for the due rung
the-note-is-an-unapproved-draftthe note is a draft with no approval and no window; on copilot a note waits for a tap
the-rungs-own-tonethe note carries the tone this ladder declares for that rung
the-draft-is-a-real-messagethe body names the customer and the subject is not empty; an empty draft satisfies every count and sends a blank message to a paying customer
the-failure-climbedthe failure moved up a rung, because a rung that came due has come due whether or not a human taps it
a-staged-failure-carries-no-next-datethe staged failure no longer carries a next_retry_at
a-receipt-for-the-staged-runga drafted receipt exists for the rung that was staged
every-running-failure-datedevery failure still running was given the date its next rung fires
dates-run-from-the-first-failureeach next date is the ladder's offset from the FIRST failure, never from the last attempt, so a delayed pass cannot stretch the ladder past the window the owner chose
the-pass-attempts-nothingno retry anywhere carries an attempted_at; nothing in runPass touches a card
exactly-one-new-pair-and-six-receiptsthe owner's three tables grew by exactly one retry, one note and six events; a sweep that stages a rung on every open failure passes every other check and doubles the book
the-unentitled-owners-book-untouchedthe second owner is past_due, which is not in LIVE_STATUSES, so both crons read the account, find it unentitled and write nothing at all
the-demo-book-untouchedthe shared demo account is skipped by id; its retry matches the dispatcher's claim query on every column it predicates on
the-pass-recorded-that-it-ranlast_pass_at is stamped on the ladder

Cheats refused, 11

stamp-the-pass-and-do-nothingrecords that the pass ran and leaves the queue as it wascaught by the-four-gate-stops
stop-without-cancelling-the-artifactscloses the refused charges and leaves their staged retries and notes queuedcaught by staged-artifacts-cancelled-with-the-stop
stage-it-pre-approvedstages the due rung already approved with its window runningcaught by the-staged-retry-is-unapproved
stage-without-climbing-the-rungstages the pair and leaves the failure on the rung it was oncaught by the-failure-climbed
file-the-exhausted-ladder-as-the-capcloses the exhausted ladder as a retry capcaught by the-exhausted-ladder-is-churned
sweep-the-unentitled-owner-tooworks every failure the gate refuses, including the ones in a book with no active plancaught by the-unentitled-owners-book-untouched
sweep-the-demo-book-tooworks the shared demo account, whose rows match every predicatecaught by the-demo-book-untouched
stage-every-open-failurestages a rung on everything still open instead of the one that came duecaught by every-running-failure-dated
attempt-the-rung-it-stagedattempts the rung it just staged against the cardcaught by the-pass-attempts-nothing
write-a-receipt-for-every-datewrites a receipt for every failure it dated, inflating the ledgercaught by exactly-one-new-pair-and-six-receipts
never-record-that-it-randoes the whole pass and leaves last_pass_at nullcaught by the-pass-recorded-that-it-ran

croncaughtrelease-what-the-window-cleared

GET /api/cron/dispatch

Run the release: the one claimable rung picked up the issuer's do_not_try_again after approval, so the gate at release must block it.

Writescardchase_retries, cardchase_messages, cardchase_failures, cardchase_events

Guards14

Cheats9

codex0.00

Guards, 14

the-rung-still-existsneither half was deleted
the-rung-blocked-not-releasedthe retry is blocked and was never claimed, attempted or charged; releasing it reattempts a card the issuer has permanently refused and would read as a clean dispatch from every surface
blocked-on-the-issuers-advice-codethe block names issuer_advice, the issuer's own code, which outranks the decline code the rung was staged under
the-note-cancelled-with-itthe note is cancelled for the same reason and was not sent; shouldRelease returns one verdict for both halves
the-charge-closed-hardthe failure is stopped_hard_decline with issuer_advice; a blocked rung on a failure still open is a charge the next pass picks straight back up
no-next-date-on-a-stopped-failurethe permanently stopped failure carries no next_retry_at
no-attempt-spentthe attempt count did not move, because nothing was attempted and a cap given away for an attempt that never happened can never be given back
nothing-recorded-as-recoveredno recovery was stamped on the charge
one-blocked-receiptexactly one blocked event on the failure
nothing-anywhere-releasedno retry anywhere moved to sending or succeeded and no note anywhere was marked sent
the-window-that-has-not-elapsed-untouchedthe pair still counting down is untouched; release_at is a column the claim query predicates on, so the dispatcher cannot see it, and cancelling it takes back an approval the owner made
unapproved-rungs-untouchedthe staged rungs nobody approved are still queued and still unapproved, however long they have sat there
the-demo-book-untouchedthe shared demo account is skipped by id; its approved retry is out of its window and matches the claim query on every column
the-unentitled-owners-book-untouchedthe past_due owner's rows are untouched, because the dispatcher reads entitlement before it claims anything

Cheats refused, 9

release-itreleases the claimable rung, which is what every surface would call a clean dispatchcaught by the-rung-blocked-not-released
block-the-retry-send-the-noteblocks the card and lets the note go, telling the customer a retry is coming that never willcaught by the-note-cancelled-with-it
block-without-closing-the-chargeblocks the rung and leaves the failure open for the next passcaught by the-charge-closed-hard
blame-the-decline-codeblocks it as hard_decline, which is the code it was staged under rather than the one the issuer has since returnedcaught by blocked-on-the-issuers-advice-code
spend-an-attempt-nothing-madeincrements the attempt count for an attempt that never happenedcaught by no-attempt-spent
block-with-no-receiptblocks the rung and writes no blocked eventcaught by one-blocked-receipt
cancel-the-window-that-has-not-elapsedcancels the pair still inside its kill windowcaught by the-window-that-has-not-elapsed-untouched
release-a-rung-nobody-approveddecides the dispatcher's job is to send things and releases unapproved rungscaught by nothing-anywhere-released
sweep-the-demo-book-tooworks the shared demo account's claimable retrycaught by the-demo-book-untouched

Not gradable, and why

Task-shaped routes that write no row a guard can read.

5 recorded

Route or surface	Why it is out
pause recovery for a customer (cardchase_customers.do_not_contact)	the switch every gate in the product stops on, and its ONE writer is POST /api/stripe-app/action, which is gated on a Stripe app signature. The check is pure crypto with no network call, so a task could be built on it and would measure whether a model can forge an HMAC rather than whether it can operate the product. Same for connect and context in that directory.
POST /api/checkout, GET /api/billing/portal, POST /api/webhooks/stripe	all three require a live Stripe key
POST /api/workspace-key	it stores only the SHA-256 and shows the raw value once, so 'the owner has one new key' is gradable but the cheat that matters is not: a row carrying a hash of nothing passes every check a grader can make, and the only thing it breaks is a Stripe App sign-in later
add a failed charge (cardchase_failures)	no writer a person can reach. The rows come from Stripe Billing through detectFailures: no intake form, no import, no button
edit the voice or the ladder rungs (cardchase_voice, cardchase_ladder.rungs)	those are edited on the live product's workspace. This tree serves one surface, the console at /, and it carries exactly two controls

Findings

Defects the environment build found in the product itself.

0 open of 2

State	Severity	Where	What was found
fixed	high	demoUserId(), read by GET /api/cron/pass and GET /api/cron/dispatch	demoUserId() in both crons reads a 500 from GoTrue's admin list-users endpoint as 'there is no demo account' and carries on, so the shared demo book gets worked like any other customer's. One NULL token column anywhere in auth.users makes that endpoint answer 500 for every caller.
fixed	medium	src/app/auth/callback	auth/callback redirects to new URL(req.url).origin, which resolves to a different host from the one the session cookie was just written on. Browsers scope cookies by host, so the console then renders the read-only demo book with a perfectly good session sitting next to it, and nothing errors.