Console and deploy follow-ups from the codebase review (#197)

[richardmhope]

Closes #197 — the last of its three sections, after the API (#205) and core/connectors (#206).

1. A crafted link could put words in the console's own chrome

A failed save redirects carrying its reason, and that reason travelled as plain query text. Autoescaped, so never script — but /login?error=Your account is locked, call 555-0100 renders inside this console's own frame and reads exactly as though this console said it.

The reason is now a signed two-minute token under the session key, minted by the same JWT-with-an-audience mechanism the login state already uses, and a page renders nothing for anything it cannot verify.

• Signed, not an enum of codes — the API's own sentence (base_url: is not a valid URL) is the useful half, and codes would throw it away.
• Signed, not a server-side flash — this deployment keeps no per-user state between requests, which is why the login state rides in a cookie too.
• Two minutes — a URL pasted into a chat later shows nothing rather than a stale complaint.

Seven pages read it (/login, /schedules, /suppressions, /channels, /users, /engines, /ownership); a parametrised test posts phishing text at every one.

2. A successful triage left the rest of the page stale

The swap updated #triage only, so the header's state chips and the Record card's assignee, owner and due date went on showing pre-save values until somebody reloaded. docs/web.md already said what to do here — "where a change is bigger than one region, the mutation answers hx_redirect()" — so it does.

A rejected triage still answers the panel: nothing moved, and navigating away would take the analyst off the explanation of why. There's a test for each half.

3. The "assigned to you" tile counted one capped page

An analyst with 300 open findings assigned saw a number derived from the first 200 rows — and, unlike its unassigned sibling, the tile did not even admit the cap. It's a query now (assignee_id=, which the API already supported), with the same + every other tile uses.

The test drives it with OVERVIEW_LIMIT monkeypatched to 2 rather than 200 fixtures, and scopes its assertion to this tile — a page-wide search for "2+" passes without the fix, because the open-findings tile is capped in the same fixture.

4. The gitleaks image is pinned by digest

test_ci_actions_are_pinned_to_a_commit's own docstring claimed this repository pins "the gitleaks image". It did not — a mutable tag, on a container that runs with the whole repository history mounted into it. Now ghcr.io/gitleaks/gitleaks@sha256:691af3c… (v8.30.0, resolved from the registry), and the invariant covers images as well as actions.

Scoped to ci.yml rather than every docker run in the tree: verify-chart.sh's helm image is a laptop fallback CI never reaches, and now says so where it's set.

5. verify-chart.sh: a contradictory log and a sidecar-shaped hole

• It printed ok every workload runs non-root, unprivileged, read-only… unconditionally, after a loop that may have just recorded failures. The exit code was right; the log said the opposite, and the log is what somebody reads.
• It inspected containers[0], so a sidecar (or an initContainer) would have walked straight past every hardening check.

Both fixed, and failures now name which container. Verified by extracting the embedded Python and running it against synthetic manifests — a pod with a hardened primary and an unhardened sidecar produces api/sneaky allows privilege escalation, …does not drop all capabilities, …declares no resource requests, and no green line; a clean set produces the green line and nothing else.

Also: the drain bound, from the #202 review

The bot flagged the drain budget as per-thread. It isn't — join_all deducts elapsed time, so the worker threads share one budget — but the observation next door is real: Worker.stop then joins the consumers under a second budget of the same size. The invariant asserted only "under the grace period"; it now requires a 20-second margin, and both the docstring and docs/deployment.md explain that a consumer join costs seconds in practice but "in practice" is not a bound.

Validation

Every fix has a test confirmed to fail against the code before it. New: test_flash.py, plus tests in test_web_screens.py, test_web_ownership.py and test_deploy_invariants.py.

make check green: ruff, mypy (285 files), docs check, 2024 passed / 2 skipped.

---

Generated by Claude Code

[icebergai-review-bot]

Verdict

APPROVE

Completed bounded review across 1 immutable scope(s). No actionable findings in the supplied immutable change.

Scope health

Convergence: healthy. Review mode: initial.
Recommended action: CONTINUE_INCREMENTAL.

• No escalation signals.

Prior findings

Finding	Status
—	No prior finding state

New findings

No new findings.

Fix-induced regressions

• None evidenced.

Uncertainty

• No material uncertainty recorded.

Validation

• Reviewed the supplied diff; exact-head CI is reported as passed.
• No prior findings were supplied for recheck.

Residual risks

• None identified.