Problem
Whitespace-only sender/body pass the truthiness guard and reach triage/storage; whitespace orderId passes the policy check then looks up garbage downstream.
Where
app/api/inbound/route.ts (if (!body.sender || !body.body)) + lib/policy.ts (if (!payload.orderId)).
Acceptance
Add a failing test first asserting POST /api/inbound {sender: " ", body: " "} returns 400 and decide with orderId: " " escalates for a missing order number. Then fix.
Problem
Whitespace-only
sender/bodypass the truthiness guard and reach triage/storage; whitespaceorderIdpasses the policy check then looks up garbage downstream.Where
app/api/inbound/route.ts(if (!body.sender || !body.body)) +lib/policy.ts(if (!payload.orderId)).Acceptance
Add a failing test first asserting
POST /api/inbound {sender: " ", body: " "}returns 400 anddecidewithorderId: " "escalates for a missing order number. Then fix.