Replace the typographic dashes on every page
612 dashes across 22 of the 30 pages. No page ends a line with a
space afterwards, and 566 dashes that would have started a Markdown list are
escaped so the list does not appear.
A wiki has no pull request and no gate, so the counts before and after are the
evidence: the run is recorded in iderex/operations#861.
Part of the fleet-wide pass in iderex/operations#860.
Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Move five process pages to local docs; first-person voice
Delivery-Metrics, Native-OIDC-Coexistence, Roadmap,
Security-and-Maturity-Self-Assessment, and Threat-Model now live in the
project's internal docs/ (kept locally, not published); each wiki page is
reduced to a short "moved, now internal" stub for URL stability, and the
sidebar drops them. Also fix a third-person "the maintainer" translation
artifact (it means me, the sole author) in Releasing, Review-Gate, and
Security-Conformance.
Refs #987
Updated Security Conformance (markdown)
Consolidate the wiki: canonical Coding Standards, merged Architecture, split Provider Setup
Restructure the wiki into one coherent, audience-grouped set with a single home
for each fact.
- New Coding-Standards page: the one canonical statement of the architecture,
comment/documentation (#864), and object-oriented rules; the repo's CLAUDE.md
and CONTRIBUTING.md now point here instead of restating them.
- Merged the two stale, mutually-overlapping Architecture pages into one, re-based
on the current module-DAG reality (the old pages claimed the module split was
"not pursued" and that no IPluginServiceRegistrator existed — both were wrong
and contradicted docs/ARCHITECTURE.md). Cites modules and types, never
file:line, so it cannot drift on a move again.
- Split Provider-Setup (1172 lines, ~73% not provider-specific) into Provider
Setup (recipes) + a new Hardening & Options Reference; folded the security-
control narrative into the Security Model. Every moved section left a pointer.
- Merged Release-Policy + Release-QA-Checklist into Releasing (renamed the
per-release ladder to "release promotion ladder" to end the Beta-rung name
collision); merged OpenSSF-Best-Practices + Maturity-Map into Security &
Maturity Self-Assessment. Old slugs kept as redirect stubs.
- Rebuilt the sidebar into four audience groups (Getting started / How it works /
Security / Standards & process). Fixed the broken anchors, corrected the beta
publish-trigger to the daily scheduler (it is not "every merge"), de-referenced
the design records to module/type names, and trimmed Home's README duplication.
Record the minimum signing-key strength floor as Met (#733)
Reflect the OIDC SSRF parity landing (#755) in the security docs
The Security-Conformance V12 row flips from Met(avatar)/Partial(OIDC) to Met (the shared hardened transport in Api/Net/SsoHttp now guards discovery/JWKS/token/userinfo), and the #755 accepted-residual is removed; the Security-Model SSRF section is broadened from avatar-only to all outbound fetches with the shared connect-time guard.
Publish the ASVS 5.0 + RFC 9700 security conformance self-assessment [#734]
New Security-Conformance wiki page: maps the RP authentication surface to OWASP ASVS 5.0 (V1 output/CSP, V6 auth incl. id_token + SAML XSW resistance, V7 session/revocation, V8 authz/last-admin, V11 crypto, V12 SSRF, brute-force) and the RFC 9700 OAuth BCP (PKCE-S256, exact redirect-URI, RFC 9207 iss/mix-up, no implicit/hybrid/ROPC; DPoP/JARM/PAR N-A-by-role justified), each row Met/Partial/N-A with a source-file citation. Accepted-residuals section records the min-key-strength floor (#733) and discovery/JWKS SSRF parity (#755) as open with reasoned risk, header completeness as met, and #708 as fixed. Framed as a maintainer self-assessment, no certification. Linked from Home and the sidebar.