backlog: file #1051-#1055, the V13 and V16 defects -- ASVS survey now 345/345 - #223
Merged
Conversation
…16 re-verification The 2026-08-05 ASVS 5.0.0 re-verification completed all 345 cells (V16 was the last). V13 and V16 each surfaced defects that were quarantined from scoring (the docs pass; the residuals are behavioural or doc-drift). All five are LOW and public-appropriate: #1051 [low] async-delivery retry_max_attempts=None (retry forever) vs documented sync-HTTP guidance #1052 [low] unbounded connector-tier / store pool acquire on three services #1053 [low] SERVICE.md calls JSON + off-box logging "planned" while both are built (doc drift) #1054 [low] opt-in sandbox child logs unfiltered (bypasses redaction + scrub) #1055 [low] unreplaced threading.excepthook on the sandbox reader (unredacted traceback) Numbers via scripts/coord/alloc.ps1. Full file:line detail in the maintainer-internal ASVS V13/V16 chapter reports (docs/security/, withheld per SECURITY-DOCS-POLICY.md). Each item is a 🔢 not-started banner. On a fresh branch off main so PR #220 (#1042-#1049) stays untouched.
wshallwshall
enabled auto-merge (squash)
August 6, 2026 00:35
wshallwshall
added a commit
that referenced
this pull request
Aug 6, 2026
…lision PRs #222 and #223 landed since the last merge, so docs/BACKLOG.md collided at EOF again: #223 appends #1051-#1055 where this branch appends #1041. One conflicted file, resolved KEEP ALL SIDES, no renumbering and no re-sorting -- the file is not ordered by number and nothing enforces one, so a re-sort would be a large invented diff over a file several branches are appending to concurrently. Resolved here rather than by the coordinator for the same entitlement reason as before: a resolution that RE-INTRODUCES the `## 1041.` heading is a head-minus-base addition, so ledger_check.py consults owns() for it (:340, :355), and the allocation record names this worktree. No other worktree can commit it. THE REVERT CHECK RAN FIRST, because the last merge is what taught me to. This branch carried content main had since changed, and if my side won those lines the merge would silently revert them while the diff looked ordinary. Built the merged tree and read it rather than inferring from a clean-looking diff: headings on main but LOST here NONE headings this branch adds vs main ## 1041. -- exactly one #1032 banner "SHIPPED 2026-08-05 - merged as PR #214" (#222's close survives; my side still carried the pre-#222 banner) #1051-#1055 from #223 5 of 5 present "Lost nothing, gained exactly one" is the check that answers the revert question directly. An item count cannot: it held steady at 121 across the previous merge because #218's additions landed INSIDE item #1000 rather than as new headings. This time it grew 121 -> 126, matching #223's five, which is consistent rather than coincidental. Verified with the repo's own parser, never a hand-rolled scan of this file: zero conflict markers, backlog_status_check OK at 321 items each declaring exactly one status, parse_items reporting zero duplicate numbers, nothing in #1032-#1055 appearing more than once, and #1041 still open -- it lands open by design and is closed by the session building the rule 3d fix. KEEP-BOTH RE-CHECKED ON THE GATE, by AST rather than by grep. A string search cannot tell a definition from a call site or a comment, and the specific hazard here is that git left the two helpers' shared closing brace outside an earlier conflict region -- a careless resolve yields a file that parses cleanly with one function swallowed into the other's body. The parser reports both ConvertTo-WorktreeSlug and Get-SafeForMessage as FunctionDefinitionAst, 8 functions total, 0 parse errors.
wshallwshall
added a commit
that referenced
this pull request
Aug 6, 2026
…t the BACKLOG EOF conflict Both this branch (#1042-#1049) and main (#1051-#1055, landed via #223) appended new items at the EOF of docs/BACKLOG.md. Resolved by KEEPING ALL sides -- no renumber, no re-sort (the file is not number-ordered). Revert-check by SET DIFFERENCE (not count): 0 headings lost vs main; headings added vs main == exactly [1042..1049]; #1032 banner reads SHIPPED ("NOT yet merged" count 0); #1050 (the owner-ruled private-only HIGH finding) ABSENT from the public file. backlog_status_check.py green (133 items, each exactly one status, no duplicate numbers); 0 conflict markers; #1042-#1055 each present exactly once.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Files BACKLOG #1051-#1055, the five LOW engine defects from the ASVS 5.0.0 re-verification of chapters V13 and V16. Docs-only, one file.
retry_max_attempts=Noneretries foreverSERVICE.mdJSON/off-box "planned" doc-driftthreading.excepthookis never replacedEach is a sanitized not-started item citing the maintainer-internal chapter report for file:line detail.
docs/security/is deny-listed from the public tree, so these carry the what and the verdict while the where stays private.This completes the ASVS re-verification
The survey is 345/345 = 100% verified, zero unverified cells. Five chapters landed in one session (V15, V4, V1, V13, V16), and every cell now carries a verdict re-derived against the pinned 5.0.0 text at a known commit.
Fourteen engine defects were filed from it: #1042-#1049 (PR #220), #1051-#1055 (here), and one HIGH recorded privately only in the vault register, with no public trace by number or description. Verified on this branch:
parse_itemsreports the new items as exactly #1051-#1055, and the private item is absent.EOF conflict, expected
This branch, PR #220 (#1042-#1049) and PR #219 all append at the EOF of
docs/BACKLOG.md, so they conflict pairwise. The resolution is keep all -- it is not a revert.#1042-#1055 all belong to one session, so if either of its branches goes dirty behind the other, that session resolves it. Note the entitlement rule that makes this non-delegable:
ledger_check.pyconsultsowns()only for headings newly introduced relative to base, so whoever re-introduces these headings in a conflict resolution must be the worktree that allocated them.Verification
Numbers allocated atomically via
alloc.ps1. Off currentorigin/main(a0a5acfa), zero behind. Pre-commit at commit time: ledger gate passed, forbidden-content (PHI/customer) passed, secrets passed.backlog_status_check.pygreen.