DongHyeonkaandClaude Opus 5
8157ad4029
Adversarial re-verification of the gate itself found three holes. The disposition check matched the finding's verdict anywhere in the table row, and every row also carries the prior verdict — so `| NS-01 | PARTIAL | FIXED |` satisfied a receipt that said either. It now reads the disposition from its own column, which is the check the gate was supposed to be performing all along. An evidence path only had to exist. A row could point at an unrelated suite and look substantiated, so each evidence file must now name the finding it is evidence for; rows the review labelled differently declare their own markers rather than the check being loosened. The file-transfer bundle budget was a number typed into prose next to a number in config, which is exactly the evidence drift the cross-audit raised. The gate now compares them. Each hole was confirmed by breaking the input and watching the gate fail: a disposition disagreement, a budget changed to 60,000, and NS-07 pointed at the public cache suite. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
189 lines
7.6 KiB
JSON
189 lines
7.6 KiB
JSON
{
|
|
"schemaVersion": 1,
|
|
"review": "third-review-2026-08-14",
|
|
"note": "GOV-03. The machine-readable disposition of every finding the third re-review raised. `check:remediation-ledger` joins this file against the prose ledger and refuses a blanket closure claim while any row is not FIXED, so a summary sentence can never outrun the evidence.",
|
|
"dispositions": [
|
|
{
|
|
"id": "NS-01",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "A credential owner's answer is decoded once, inside the auth boundary, through own data descriptors.",
|
|
"evidence": ["tests/integration/http-execution-v3-live-authority.test.ts"]
|
|
},
|
|
{
|
|
"id": "NS-02",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "Contract composition snapshots first and validates the snapshot, so the installed row is the row that was checked.",
|
|
"evidence": ["tests/unit/contract-registry-immutability.test.ts"]
|
|
},
|
|
{
|
|
"id": "NS-03",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "The `responseBody: NONE` probe owns its reader: the operation lifetime reaches it, and the lock is released.",
|
|
"evidence": ["tests/integration/http-execution-v3-live-authority.test.ts"]
|
|
},
|
|
{
|
|
"id": "NS-04",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "A journal transaction that cannot be completed is maintenance debt, not a settled write.",
|
|
"evidence": ["tests/unit/opfs-byte-store.test.ts"]
|
|
},
|
|
{
|
|
"id": "NS-05",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "A bootstrap failure answers with the request kind it belongs to, so the real cause survives the gateway.",
|
|
"evidence": ["tests/unit/opfs-worker-runtime.test.ts"]
|
|
},
|
|
{
|
|
"id": "NS-06",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "A reply is decoded before its pending row is released, and an uncorrelatable reply fails the channel closed.",
|
|
"evidence": ["tests/unit/opfs-worker-runtime.test.ts"]
|
|
},
|
|
{
|
|
"id": "NS-07",
|
|
"previous": "NEW",
|
|
"disposition": "FIXED",
|
|
"summary": "Cursor caps and collaborators are captured at construction, so a later mutation cannot widen a validated cap.",
|
|
"evidence": ["tests/unit/cursor-pagination-runtime.test.ts"]
|
|
},
|
|
{
|
|
"id": "NS-08",
|
|
"previous": "NEW",
|
|
"disposition": "FIXED",
|
|
"summary": "One terminal owner covers the whole public-cache staging body, so nothing writes after the abort.",
|
|
"evidence": ["tests/unit/public-response-cache.test.ts"]
|
|
},
|
|
{
|
|
"id": "RPC-01",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "Only a fulfilled, contract-shaped `waitClosed()` receipt prunes an active stream registration.",
|
|
"evidence": ["tests/unit/browser-rpc/browser-rpc-remediation.test.ts"]
|
|
},
|
|
{
|
|
"id": "RPC-02",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "Iterator cleanup and the lease decoder read foreign state inside their own boundaries.",
|
|
"evidence": ["tests/unit/browser-rpc/browser-rpc-remediation.test.ts"]
|
|
},
|
|
{
|
|
"id": "RPC-03",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "Every registry is snapshotted before any validation runs, and rows with hidden fields are refused.",
|
|
"evidence": ["tests/unit/browser-rpc/browser-rpc-remediation.test.ts"]
|
|
},
|
|
{
|
|
"id": "RPC-04",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "A transport result is an exact union: required own keys, no inherited extras, plain prototype.",
|
|
"evidence": ["tests/unit/browser-rpc/browser-rpc-remediation.test.ts"]
|
|
},
|
|
{
|
|
"id": "RT-01",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "A tracked task is registered before the authority is invoked, closing the reentrant-close window.",
|
|
"evidence": ["tests/unit/realtime/stream-coordinator.test.ts"]
|
|
},
|
|
{
|
|
"id": "RT-02",
|
|
"previous": "NEW",
|
|
"disposition": "FIXED",
|
|
"summary": "A scheduler that cannot install a deadline fails closed inside the realtime result contract.",
|
|
"evidence": ["tests/unit/realtime/stream-coordinator.test.ts"]
|
|
},
|
|
{
|
|
"id": "TR-01",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "The vault snapshots a registration and everything nested in it before validating or storing it.",
|
|
"evidence": ["tests/unit/presigned-transfer.test.ts"]
|
|
},
|
|
{
|
|
"id": "TR-02",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "A source lease that arrives after the delivery ended is closed exactly once by a compensator.",
|
|
"evidence": ["tests/unit/presigned-transfer.test.ts"]
|
|
},
|
|
{
|
|
"id": "TR-03",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "The shared abort primitive settles once by observation order, and all four consumers use it with bound timer snapshots.",
|
|
"markers": ["X-AUDIT-01", "X-AUDIT-02"],
|
|
"evidence": [
|
|
"tests/unit/abortable-operation.test.ts",
|
|
"tests/unit/image-cdn-runtime.test.ts",
|
|
"tests/unit/resumable-upload-fetch-transport.test.ts"
|
|
]
|
|
},
|
|
{
|
|
"id": "TR-04",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "Teardown proves quiescence of the raw provider registry, not only of the wrappers that bound it.",
|
|
"evidence": ["tests/unit/resumable-upload-runtime.test.ts"]
|
|
},
|
|
{
|
|
"id": "TR-05",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "The control-plane decoder validates an owned snapshot, so a stateful answer cannot swap a checked value.",
|
|
"evidence": ["tests/unit/resumable-upload-http-control-plane.test.ts"]
|
|
},
|
|
{
|
|
"id": "SW-01",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "The activation marker read is bounded in bytes, cancels what it refuses and releases its reader lock.",
|
|
"evidence": ["tests/unit/service-worker-runtime.test.ts"]
|
|
},
|
|
{
|
|
"id": "SW-02",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "The generator and the runtime decoder share one canonical asset-path predicate, and the generator self-validates.",
|
|
"evidence": ["tests/unit/service-worker-web-push-remediation.test.ts"]
|
|
},
|
|
{
|
|
"id": "WP-01",
|
|
"previous": "PARTIAL",
|
|
"disposition": "FIXED",
|
|
"summary": "One observation authority per click; certainty is monotone and the late-effect tail is owned by `waitUntil`.",
|
|
"evidence": ["tests/unit/web-push-worker-runtime.test.ts"]
|
|
},
|
|
{
|
|
"id": "GOV-03",
|
|
"previous": "OPEN",
|
|
"disposition": "FIXED",
|
|
"summary": "This file plus `check:remediation-ledger` bind each row to a disposition and a test path, and block a blanket closure claim while any row is open.",
|
|
"evidence": ["scripts/check-remediation-ledger.ts"]
|
|
},
|
|
{
|
|
"id": "GOV-04",
|
|
"previous": "OPEN",
|
|
"disposition": "FIXED",
|
|
"summary": "The inventory gate requires the exact named consumer set to resolve its import to the shared primitive and prints the set.",
|
|
"evidence": ["scripts/check-adapter-inventory.ts"]
|
|
},
|
|
{
|
|
"id": "GOV-05",
|
|
"previous": "OPEN",
|
|
"disposition": "FIXED",
|
|
"summary": "Duplicate abort mechanics were consolidated onto the shared primitive and the file-transfer budget was reset to cover the remaining correctness code.",
|
|
"markers": [],
|
|
"evidence": ["config/recipes/frontend-capability-recipes.json"]
|
|
}
|
|
]
|
|
}
|