QA Review — MC #8745 for MC #8678 Intesa Bridge Leak

QA Review Final — MC #8745 reviewing MC #8678 
 Reviewer: John / Proveo QA mode 
 Date (UTC): 2026-07-28 
 Subject: MC #8678 — FIX: /intesa-bridge leak on bilko-demo.alai.no — isolate to intesa Cloud Run only 
 Verdict 
 PASS for the leak fix. Current canonical Bilko source and live public demo domains do not expose a public /intesa-bridge route. 
 Evidence checked 
 Mission Control 
 
 mc.js show 8678 : task is done ; original DoD text says intesa-bridge 404 confirmed live on bilko-demo.alai.no (commit 66d2220) and notes the CI fix was separate. 
 mc.js show 8745 : QA task existed for this review and was paused before this final evidence artifact. 
 mc.js show 8716 : follow-up task exists for the broader branch-purity/CI guard: PI2: Client prefix registry + branch purity CI , status open , priority L . 
 
 Repository inspected 
 Path: /Users/makinja/business/ALAI-Holding-AS/products/Bilko 
 
 BUILD-BLUEPRINT.md read first. It identifies azdo as the canonical remote and warns that GitHub mirrors are stale. 
 Worktree status at check time: fix/chatbot-per-user-ratelimit-105463-v2...azdo/main [ahead 1, behind 42] with unrelated modified files; therefore checks used both azdo/main and HEAD where relevant. 
 Canonical ref observed: azdo/main = c34f10e9 ; local HEAD = 68578f35 . 
 
 Git/history checks 
 
 Fix commit exists:
 
 66d222062543a59ac35d896c7f4953e67a262f64 fix(security): remove /intesa-bridge leak from public Bilko demo (MC #8678) 
 Touched/removal files under apps/web : apps/web/app/(dashboard)/intesa-bridge/page.tsx , apps/web/components/sidebar.tsx , apps/web/lib/auth-provider.tsx , apps/web/lib/intesa-bih-mock-data.ts , and locale message files. 
 
 
 Leak-introducing commit exists:
 
 13c2efb728e9eaab30aadc9cc0b392940126a9ee feat(intesa-demo): BiH-localized bank bridge demo for Intesa Sanpaolo pitch 
 
 
 
 Current source-tree leak checks 
 Commands run in the Bilko repo: 
 git ls-tree -r --name-only azdo/main apps/web/app | grep -Ei 'intesa|corpint' || true
git ls-tree -r --name-only HEAD apps/web/app | grep -Ei 'intesa|corpint' || true
find apps/web/app \( -iname '*intesa*' -o -iname '*corpint*' \) -print | sort
 
 Result: all three checks returned no matching route paths. 
 The existing E2E spec apps/e2e/tests/intesa-bridge.spec.ts is fully skipped via test.describe.skip(...) and includes a comment stating /intesa-bridge route is not implemented in apps/web/app/ yet . 
 Live domain checks 
 Commands used curl -k -sS -I -L --max-time 15 . 
 
 https://bilko-demo.alai.no/intesa-bridge — curl: Could not resolve host , HTTP 000 . This is expected for the retired GCP-era demo host. 
 https://app.bilko.io/intesa-bridge — redirects once to /login?redirect=%2Fintesa-bridge , final HTTP 200 login page. 
 https://app.bilko.cloud/intesa-bridge — redirects once to /login?redirect=%2Fintesa-bridge , final HTTP 200 login page. 
 https://app.bilko.company/intesa-bridge — redirects once to /login?redirect=%2Fintesa-bridge , final HTTP 200 login page. 
 Control path https://app.bilko.cloud/this-route-should-not-exist-xyz123 behaves the same: redirects once to /login?redirect=%2Fthis-route-should-not-exist-xyz123 , final HTTP 200 login page. 
 
 Interpretation: current public app is auth-gated before route-specific 404s, so curl cannot distinguish nonexistent private routes from existing private routes unauthenticated. Source-tree absence is therefore the decisive leak check; live probes confirm no unauthenticated Intesa content is served. 
 Deployment-map/doc checks 
 docs/DEPLOY-MAP.md and related docs record that: 
 
 Current public demo domains are app.bilko.cloud , app.bilko.io , and app.bilko.company on Azure ACA. 
 bilko-demo.alai.no is legacy/dead DNS after the GCP → Azure migration (MC #103633 / OCD-11). 
 GCP Cloud Run demo services are archived/decommissioned for current public demo use. 
 
 Evidence-file and CI-guard checks 
 
 docs/evidence/8678/verification.json is not present in the current Bilko worktree. 
 CI guard grep across azure-pipelines.yml , .github/workflows/* , and scripts/ci/* found no intesa or corpint guard in those checked files. 
 This is not a regression in #8678 because MC #8678's own DoD said: CI fix is separate task (WIF secrets) . The separate open follow-up found is MC #8716. 
 
 Findings 
 
 No current public leak found. apps/web/app contains no intesa / corpint routes on azdo/main , local HEAD , or working tree. 
 Original fix is real. Commit 66d2220 exists and removes the leaked Intesa route and related web artifacts. 
 Original proof file is stale/missing. The DoD-cited docs/evidence/8678/verification.json does not exist in the current worktree, and the original host bilko-demo.alai.no no longer resolves. 
 Preventive CI guard remains a follow-up. No checked CI file currently contains the intesa / corpint branch-purity guard; MC #8716 tracks that broader follow-up. 
 
 Recommendation 
 Close MC #8745 as QA PASS for MC #8678. Keep MC #8716 open as the low-priority preventive CI/branch-purity follow-up.