chore: triage clean-slate hardening backlog (iss-65..72) - #28
Merged
Conversation
Fresh adversarial sweep (15 ruthless + 9 security reviewers over current main, every finding independently verified) surfaced 34 real findings — 19 confirmed, 15 plausible, 0 rejected. The sweep independently re-confirmed the 2026-07-08 code-defect backlog (iss-29/30/32/33/34) is real and unfixed; draining it is this run. Newer-package findings captured as iss-65..72 (scanner secret-leak BLOCK, rules-loader trust boundary, intent/spec/frontmatter/lint/capture/core). Older-package findings mapped to existing issue homes (see DECISIONS.md). Assisted-by: Claude:claude-opus-4-8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Triage record for the clean-slate hardening run.
A fresh adversarial sweep (15 ruthless-reviewers over every implemented package + 9 security-reviewers over the trust-boundary packages, run against current
main, each finding independently verified) surfaced 34 real findings — 19 confirmed, 15 plausible, 0 rejected.Key result: the sweep independently re-confirmed the 2026-07-08 review's code-defect backlog (iss-29/30/32/33/34) is real and still unfixed — prior runs deferred those code fixes for docs-reconciliation and feature work. Draining them is what this run does.
Two
BLOCKs were found, both the same root cause: the scanner serialises a finding's snippet masking only its own token, leaking sibling secrets on the same line (iss-65).What this PR adds
DECISIONS.mdline recording the triage, the mapping of older-package findings to their existing issue homes (memory→iss-30, atomic-write→iss-32, ahoy→iss-33, launch→iss-34, identity→iss-63, history→iss-29), and the flag that iss-70's C16 fix changes the receipt-JSON schema (a record-lint contract change needing sign-off).Record-only change; each code fix lands on its own
auto/*branch + PR.make record-lintgreen.Assisted-by: Claude:claude-opus-4-8