bench · not a test suite · database writes only

Bench Build Co

Every event below is an HTTP call to a real /api/ingest/* endpoint with the real key. The approval gate, RLS, the schemas and idempotency all still apply — a 409 is a result, not a failure.

Surfaces

Three origins because three audiences. Each answers its own routes and 404s the others, so these are absolute — a relative link to the survey from here would refuse, correctly.

Portal logins

One password for all of them, and it is the seed's. Every address is .example, so none of it is mistakable for a real account.

db:bench — this builder

Three roles, because the least-privileged view is the one most likely to be wrong.

db:seed — the two builders the rules are proven against

Dave Whitlock, Tom Nguyen and Marco Ferretti are in staff with no user_id, so they cannot sign in. That is the common case — scored by customers, never signing in — and the reason the column is nullable.

seed-password-not-for-production

Revokes the token at the server, not just the cookie — so you can sign in as the next one. Also the way out after a re-seed, which deletes the user you were signed in as.