[mluck-openai]

Static verification passed. The POST /api/imports route passes parsed JSON to importInvoice; imports.mjs now performs an exact lookup for the documented schemaVersion "1" and rejects missing, unsupported, and coercion-equivalent versions before store.invoices.set. Reviewer exceptions propagate before persistence, and only review.approved === true reaches the persistence sink. The regression test source verifies that over-limit version 1 imports, unsupported version "2", and numeric version 1 are rejected without changing the invoice count. Legitimate behavior remains: documented version "1" imports still use checkAmount, and the existing normal-import test asserts a 201 response with an affirmative review. The final diff was inspected and git diff --check passed. Per static verification mode, builds, tests, reproducers, and the application were not run.

Patch verification: fixed

Static assessment of the current checkout: the authenticated POST /api/imports route still passes caller-controlled JSON to importInvoice (examples/invoice-desk/app/server.mjs:118-125,199-204), but the working-tree fix closes the original fail-open path. importInvoice now performs an exact lookup for the supported schema key, rejects a missing reviewer with HTTP 422, invokes the reviewer without a fail-open catch, and requires review.approved === true (examples/invoice-desk/app/imports.mjs:35-44). Unsupported values such as "2" or numeric 1 therefore fail before the persistence sink at lines 48-64. Any reviewer exception propagates to the server error handler at server.mjs:257-264 and cannot resume execution at store.invoices.set. The only reviewer is module-local checkAmount, which approves only amounts at or below the workspace limit (imports.mjs:4-10); the documented and UI-generated legitimate schema is string "1" (app/README.md:24-37; app/views.mjs:82-97), so supported under-limit imports still reach persistence. The focused regression test source rejects an over-limit supported document, unsupported string and numeric schema versions, and asserts the invoice count is unchanged (examples/invoice-desk/qa/app.test.mjs:155-176). No equivalent importInvoice caller or reviewer path exists in the sample. This was static verification only; builds, tests, reproducers, and the application were not run.

Verification applies to this saved patch. It does not mark the finding fixed on the target branch.

• Finding: acf_22c53f09bdd70500269c0fd5baf38f83
• Patch: arp_5f1dfb12ccdd9da12d4bc9985788ee80
• Base commit: 28a18608984edbc5b849dc60fb3da20af948c5ae
• Patch SHA-256: 430277d1f9a0542bd108c65497555326a32784176b6a62ee023f5eaa8d947461