# QA Review — MC #8745 for MC #8678 Intesa Bridge Leak

# QA Review Final — MC #8745 reviewing MC #8678

**Reviewer:** John / Proveo QA mode  
**Date (UTC):** 2026-07-28  
**Subject:** MC #8678 — `FIX: /intesa-bridge leak on bilko-demo.alai.no — isolate to intesa Cloud Run only`

## Verdict

**PASS for the leak fix.** Current canonical Bilko source and live public demo domains do not expose a public `/intesa-bridge` route.

## Evidence checked

### Mission Control

- `mc.js show 8678`: task is `done`; original DoD text says `intesa-bridge 404 confirmed live on bilko-demo.alai.no (commit 66d2220)` and notes the CI fix was separate.
- `mc.js show 8745`: QA task existed for this review and was paused before this final evidence artifact.
- `mc.js show 8716`: follow-up task exists for the broader branch-purity/CI guard: `PI2: Client prefix registry + branch purity CI`, status `open`, priority `L`.

### Repository inspected

Path: `/Users/makinja/business/ALAI-Holding-AS/products/Bilko`

- `BUILD-BLUEPRINT.md` read first. It identifies `azdo` as the canonical remote and warns that GitHub mirrors are stale.
- Worktree status at check time: `fix/chatbot-per-user-ratelimit-105463-v2...azdo/main [ahead 1, behind 42]` with unrelated modified files; therefore checks used both `azdo/main` and `HEAD` where relevant.
- Canonical ref observed: `azdo/main` = `c34f10e9`; local `HEAD` = `68578f35`.

### Git/history checks

- Fix commit exists:
  - `66d222062543a59ac35d896c7f4953e67a262f64 fix(security): remove /intesa-bridge leak from public Bilko demo (MC #8678)`
  - Touched/removal files under `apps/web`: `apps/web/app/(dashboard)/intesa-bridge/page.tsx`, `apps/web/components/sidebar.tsx`, `apps/web/lib/auth-provider.tsx`, `apps/web/lib/intesa-bih-mock-data.ts`, and locale message files.
- Leak-introducing commit exists:
  - `13c2efb728e9eaab30aadc9cc0b392940126a9ee feat(intesa-demo): BiH-localized bank bridge demo for Intesa Sanpaolo pitch`

### Current source-tree leak checks

Commands run in the Bilko repo:

```bash
git ls-tree -r --name-only azdo/main apps/web/app | grep -Ei 'intesa|corpint' || true
git ls-tree -r --name-only HEAD apps/web/app | grep -Ei 'intesa|corpint' || true
find apps/web/app \( -iname '*intesa*' -o -iname '*corpint*' \) -print | sort
```

Result: all three checks returned no matching route paths.

The existing E2E spec `apps/e2e/tests/intesa-bridge.spec.ts` is fully skipped via `test.describe.skip(...)` and includes a comment stating `/intesa-bridge route is not implemented in apps/web/app/ yet`.

### Live domain checks

Commands used `curl -k -sS -I -L --max-time 15`.

- `https://bilko-demo.alai.no/intesa-bridge` — `curl: Could not resolve host`, HTTP `000`. This is expected for the retired GCP-era demo host.
- `https://app.bilko.io/intesa-bridge` — redirects once to `/login?redirect=%2Fintesa-bridge`, final HTTP `200` login page.
- `https://app.bilko.cloud/intesa-bridge` — redirects once to `/login?redirect=%2Fintesa-bridge`, final HTTP `200` login page.
- `https://app.bilko.company/intesa-bridge` — redirects once to `/login?redirect=%2Fintesa-bridge`, final HTTP `200` login page.
- Control path `https://app.bilko.cloud/this-route-should-not-exist-xyz123` behaves the same: redirects once to `/login?redirect=%2Fthis-route-should-not-exist-xyz123`, final HTTP `200` login page.

Interpretation: current public app is auth-gated before route-specific 404s, so curl cannot distinguish nonexistent private routes from existing private routes unauthenticated. Source-tree absence is therefore the decisive leak check; live probes confirm no unauthenticated Intesa content is served.

### Deployment-map/doc checks

`docs/DEPLOY-MAP.md` and related docs record that:

- Current public demo domains are `app.bilko.cloud`, `app.bilko.io`, and `app.bilko.company` on Azure ACA.
- `bilko-demo.alai.no` is legacy/dead DNS after the GCP → Azure migration (MC #103633 / OCD-11).
- GCP Cloud Run demo services are archived/decommissioned for current public demo use.

### Evidence-file and CI-guard checks

- `docs/evidence/8678/verification.json` is **not present** in the current Bilko worktree.
- CI guard grep across `azure-pipelines.yml`, `.github/workflows/*`, and `scripts/ci/*` found no `intesa` or `corpint` guard in those checked files.
- This is not a regression in #8678 because MC #8678's own DoD said: `CI fix is separate task (WIF secrets)`. The separate open follow-up found is MC #8716.

## Findings

1. **No current public leak found.** `apps/web/app` contains no `intesa`/`corpint` routes on `azdo/main`, local `HEAD`, or working tree.
2. **Original fix is real.** Commit `66d2220` exists and removes the leaked Intesa route and related web artifacts.
3. **Original proof file is stale/missing.** The DoD-cited `docs/evidence/8678/verification.json` does not exist in the current worktree, and the original host `bilko-demo.alai.no` no longer resolves.
4. **Preventive CI guard remains a follow-up.** No checked CI file currently contains the `intesa`/`corpint` branch-purity guard; MC #8716 tracks that broader follow-up.

## Recommendation

Close MC #8745 as **QA PASS** for MC #8678. Keep MC #8716 open as the low-priority preventive CI/branch-purity follow-up.