feat: add Ticket and Status columns to the audit findings register#39
Merged
Conversation
…gister Every finding in the register now links to its real GitHub issue and shows that issue's current tracker state, not just the six from last week's pass. Searched traverse-framework/traverse for a matching issue per finding rather than guessing numbers: 11 of the 15 original July findings had real tickets (mostly #580-#596, filed together, matching this audit's own numbering pattern), plus #627 for the registry-extraction finding. The remaining 4 (bearer-token impersonation, data store durability, private-trace durability, spec-022 governance drift) turned up no match after multiple search attempts — shown honestly as "Not filed" rather than invented. Status is the linked issue's literal GitHub state (Open/Closed), not a re-audit of whether the fix actually landed correctly — a note above the table says so explicitly, since 11 closed tickets sitting next to still-open findings text could otherwise read as "verified fixed." New-findings section now uses the same two columns instead of an inline link baked into the finding text (which is what last week's pass did before this column existed). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The findings register only had issue links baked into the finding text for last week's 6 new findings — the original 15 had no ticket references at all, and nothing showed status anywhere. Adds two real columns: Ticket (linked) and Status (tracker state), covering all 21 findings.
Rather than guess ticket numbers for the original 15, I searched
traverse-framework/traversefor a matching issue per finding. 11 had real tickets — mostly#580–#596, filed together, which lines up with this being the original audit's own issue batch — plus#627for the registry-extraction finding. Four turned up nothing after several search attempts:--allow-unauthenticatedimpersonationThose four show "Not filed" rather than an invented number.
Status shows the linked issue's literal GitHub state (Open/Closed) — it is explicitly not a re-audit of whether the fix actually landed in code. Added a note above the table saying so, since 11 closed tickets sitting next to their original finding text could otherwise read as "verified fixed," which isn't a claim this PR makes.
The six newest findings (from the previous audit-update PR) move from an inline link inside the finding text to the same two structured columns, for consistency.
Test plan
npm run buildclean🤖 Generated with Claude Code