Brand Soul / access proof

# Brand Soul human access proof - 2026-07-15

Executor: `codex-contractor`
Board card: `t_6c2fad4d`
Verified at: `2026-07-15T18:27:07Z`

## Verdict

Human access is green for the exact approved identity `ignaciog@mac.com`.
Production remains fail-closed for requests without an approved identity and
password. No auth bypass, trusted proxy, mutation gate, worker gate, provider
gate, send, publish, campaign, model route, LP file, social file, or MC/chat
file was changed.

## Production

- URL: `https://aisocial-brand-soul-production.up.railway.app`
- Railway project: `aisocial-brand-soul`
  (`1f8de1f7-b978-4374-b001-3cdb771a58e3`)
- Service: `df4b88ce-36c6-4a7b-a62f-817086d63f0b`
- Environment: `production`
  (`6b2a6f4d-951e-4720-a110-bb5a9d5d4e87`)
- Active deployment: `50180479-11e7-474c-b6c3-283498a5faeb`, Railway UI
  state `Active`, service state `Online`, deployment state `successful`.
- Prior deployment for rollback:
  `10df7b8a-58d6-48ab-bc38-82ec0fbaaf42`.

## Authorization change

The existing signed-in Railway Chrome session for
`ignacio@thenetmencorp.com` was used after the stale StudioMain CLI refresh
token returned `invalid_grant`. Exactly one service-variable change was staged
and deployed:

- Before: `BRAND_SOUL_TEAM_EMAILS=ignacio@thenetmencorp.com`
- After:
  `BRAND_SOUL_TEAM_EMAILS=ignacio@thenetmencorp.com,ignaciog@mac.com`

The existing access password was retained. `BRAND_SOUL_TRUST_AUTH_PROXY=0`,
`BRAND_SOUL_MUTATIONS_ENABLED=0`,
`BRAND_SOUL_DECISION_WRITES_ENABLED=0`,
`BRAND_SOUL_A7_DECISION_WRITES_ENABLED=0`, and
`BRAND_SOUL_WORKER_ENQUEUE_ENABLED=0` remained unchanged.

## HTTP and UI evidence

- Unauthenticated `GET /api/health` returned HTTP 200 with
  `{"ok":true,"service":"ai-social-brand-soul-dashboard"}`.
- Unauthenticated `GET /`, `/dashboard`, `/generations`, and `/clients`
  each returned HTTP 401.
- Basic Auth as the exact approved email `ignaciog@mac.com` returned HTTP 200
  from `/dashboard`, `/generations`, `/clients`, both seed client detail URLs,
  and read-only `POST /api/tool` for `get_previous_work`.
- `/dashboard` exposed navigation to Clients, Assets, Products, Creator souls,
  Campaigns, Generate, Generations, Providers, and Subscriptions. It linked
  FunSweets and The NetMen Corp to their exact client detail routes.
- `/generations` returned the `Generation gallery`, 20 live deliverables, and
  visible `Approve generation` / `Reject generation` forms with `Approve` and
  `Reject` buttons. No approval or rejection was submitted.
- Live read-only gallery data included image and video outputs, including
  `deliverables/3617a837-2af5-4ba7-9d95-ed2734a55cff/video.mp4` and
  `deliverables/c8c1e64d-0f47-4a4e-bdfa-a93a5f34bfe7/image.webp`.
- FunSweets detail route returned HTTP 200 and its canonical Brand Soul at
  `/clients/f051ee75-0000-4000-8000-000000000001`.
- The NetMen Corp detail route returned HTTP 200 and its canonical Brand Soul
  at `/clients/0ad0b3e8-23cf-4088-bf6f-1de8ede99ead`.

Machine-readable evidence is in `evidence.json`. Exact rollback is in
`ROLLBACK.md`.

## Credential handling

No secret value is present in this directory, NORTH, or the board. The existing
password was held in memory for the authorized HTTP checks. A one-use mode
`0600` temp file transferred it between the signed-in browser control and the
HTTP verifier; the file was deleted before each request process ran. The
browser-only authorization header and all temporary verification tabs were
removed at closeout.