backlog: file #1042-#1049, the engine defects from the ASVS V15/V4/V1 re-verification - #220
Merged
Merged
Conversation
…4/V1 re-verification The 2026-08-05 ASVS 5.0.0 re-verification of chapters V15, V4 and V1 surfaced ten engine defects. One (the V1 1.2.7 prior-na false premise) was a scorecard record correction, already applied in the V15/V4/V1 vault commits. One HIGH item is held in the maintainer-internal channel per owner decision (attacker-roadmap detail unfit for the public baseline). The remaining eight are filed here: #1042 [med] vault provider hvac client follows HTTP redirects (X-Vault-Token) #1043 [low] threat-model drift guard doc-content checks inert when the vault doc is absent #1044 [low] no request-timeout middleware on HTTP handlers #1045 [low] redact_unauthorized fails open #1046 [low] non-atomic inbound archive move (TOCTOU) in transports/file.py #1047 [low] apiclient query-string URI length unmeasured #1048 [low] OIDC token-exchange outbound length unbounded #1049 [low] XmlMessage exposes only string-expression XPath (no parameterized API) Numbers allocated via scripts/coord/alloc.ps1. Full file:line detail for each is in the maintainer-internal ASVS chapter reports (docs/security/, withheld per SECURITY-DOCS-POLICY.md). Each item is a 🔢 not-started banner; backlog_status_check.py green (128 items in BACKLOG.md).
wshallwshall
enabled auto-merge (squash)
August 5, 2026 23:28
wshallwshall
added a commit
that referenced
this pull request
Aug 6, 2026
…16 re-verification (#223) The 2026-08-05 ASVS 5.0.0 re-verification completed all 345 cells (V16 was the last). V13 and V16 each surfaced defects that were quarantined from scoring (the docs pass; the residuals are behavioural or doc-drift). All five are LOW and public-appropriate: #1051 [low] async-delivery retry_max_attempts=None (retry forever) vs documented sync-HTTP guidance #1052 [low] unbounded connector-tier / store pool acquire on three services #1053 [low] SERVICE.md calls JSON + off-box logging "planned" while both are built (doc drift) #1054 [low] opt-in sandbox child logs unfiltered (bypasses redaction + scrub) #1055 [low] unreplaced threading.excepthook on the sandbox reader (unredacted traceback) Numbers via scripts/coord/alloc.ps1. Full file:line detail in the maintainer-internal ASVS V13/V16 chapter reports (docs/security/, withheld per SECURITY-DOCS-POLICY.md). Each item is a 🔢 not-started banner. On a fresh branch off main so PR #220 (#1042-#1049) stays untouched.
…t the BACKLOG EOF conflict Both this branch (#1042-#1049) and main (#1051-#1055, landed via #223) appended new items at the EOF of docs/BACKLOG.md. Resolved by KEEPING ALL sides -- no renumber, no re-sort (the file is not number-ordered). Revert-check by SET DIFFERENCE (not count): 0 headings lost vs main; headings added vs main == exactly [1042..1049]; #1032 banner reads SHIPPED ("NOT yet merged" count 0); #1050 (the owner-ruled private-only HIGH finding) ABSENT from the public file. backlog_status_check.py green (133 items, each exactly one status, no duplicate numbers); 0 conflict markers; #1042-#1055 each present exactly once.
wshallwshall
added a commit
that referenced
this pull request
Aug 10, 2026
… as the engine (#309) test_connscale_smoke_end_to_end red on #298 with fd_count_monotonic: "fixed_per_conn@N=24: 344 < prior 3.56e+04 * 0.75". The suspect number is the PRIOR. Calibrated against this repo's own published at-scale run: ~3.0 handles/connection over an ~833 base (2333 @ N=500, 3835 @ N=1000, 5335 @ N=1500), so N=12 predicts ~870. The observed 344 at N=24 is in band. 35,600 at N=12 is 6.7x the reading for a FIFTEEN HUNDRED connection engine, and no leak produces both minutes apart in one sweep from two separately-spawned engines. Mechanism: _walk_descendants validates nothing -- no creation time, no image name, no cardinality bound. Windows keeps a stale ParentProcessId after the parent exits and recycles PIDs, so any live process pointing at the engine's recycled PID is adopted with its whole subtree. Measured on this box, walking one such stale ppid summed 144,688 handles. And in the connscale smoke the engine spawns NO children, so every descendant the walk finds is by construction not the engine. max() then latches the poisoned tick permanently -- a mean would have diluted it. My first reading was "handles has no PID-set gate like CPU does". An independent pass sharpened it and corrected the remedy: copying #220's gate would be WRONG. Differencing sums over different PID sets is arithmetically invalid, but an INSTANTANEOUS gauge over a genuinely larger subtree is correct. The gap is that the number carries no record of the set it covered. Validating the walk (reject a descendant older than its root) is the fix; gating the aggregate is not. Also recorded: #220's gate is a change-detector, not a binding check -- a first-and-only resolution that adopts a wrong-but-stable subtree passes it. And the test that shipped #220's fix asserts this exposure as correct, on a fixture that is physically unrealizable: it varies cpu_pids while pinning handles=61, though the Windows probe reads both from the same Get-Process rows. Diagnosis only. The fix shape is proposed and ranked but not applied.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Files BACKLOG #1042-#1049, the eight low/medium engine defects surfaced by the ASVS 5.0.0 re-verification of chapters V15, V4 and V1. Docs-only, one file.
Each item is a sanitized not-started entry citing the maintainer-internal chapter report for file:line detail, rather than reproducing that detail here.
Why the detail is not in these items
The full findings live in
docs/security/, which is deny-listed from the public tree perSECURITY-DOCS-POLICY.md. These items carry the what and the verdict; the where stays private. That split is deliberate and is what lets the defects be tracked publicly at all.One HIGH finding from the same re-verification is deliberately absent from this file and is recorded only in the private register. It is not referenced here, by number or by description.
Verification
alloc.ps1, not greppedbacklog_status_check.pygreen; items added are exactly #1042-#1049, verified withparse_itemsrather than a hand-rolled scanNote for whoever merges this alongside PR #219
Both this branch and #219 append at the EOF of
docs/BACKLOG.md-- #219 adds #1041, this adds #1042-#1049.git merge-treereports 1 conflict between them, which is the expected textual EOF collision and resolves by keeping both, in either order. It is not a revert.Note also that the ledger gate keys entitlement on the worktree that ran
alloc.ps1, so whichever lands second must be resolved by the session that owns those numbers, not by whoever notices the conflict.