Repository navigation
Harden planning, evidence handling and release verification - #32
Merged
slicedearth merged 9 commits intoOct 10, 2026
Merged
Conversation
Evaluate browser minimums over reviewed released populations, correct script-policy declaration semantics, preserve complete comparison totals, and classify evidence-policy weakening independently from factual changes. Reject ambiguous exceptions and invalid imports while superseding stale asynchronous work and preserving useful session-only behaviour when storage is unavailable. Bound authorised collection across repeated headers, cookie reduction, redirect and output budgets, absolute deadlines, and generated identifiers. Retain fixed-origin unauthenticated collection, exact verification identities, local-only evidence, bounded schemas, separate decision lanes, and the static no-account and no-telemetry architecture. Add deterministic transport, process, storage and browser regression coverage without weakening existing gates. Integrate the preserved dependency maintenance batch with narrow compatible advisory updates and reviewed browser-data refreshes. Retain source history, attribution and licence notices, document contract compatibility and approval-gated hosting choices, and keep optional cross-engine checks local with disposable loopback fixtures. Verified with npm run verify, npm run test (226 tests across 36 files), npm run test:e2e (28 passed), the serial three-engine smoke suite (3 passed), npm audit --audit-level=high (0 vulnerabilities), npm audit signatures (406 signatures and 138 attestations verified), generation and schema checks, and git diff --cached --check. An earlier combined smoke attempt timed out; the final isolated serial repeat passed without retries. No remote publication or deployment was performed.
Require the separate dependency audit and locked browser checks before manually requested publication can upload its static artefact. Retain exact event revision selection, read-only build permissions, successful automatic CI prerequisites, bounded execution and a dependency-free deployment job without an emergency verification bypass. Isolate root-path loopback browser builds from the publication target, then regenerate and audit the correctly based static output before upload. Expand the dedicated-origin hosting plan with explicit origin selection, response-header delivery checks, host logging and retention review, privacy boundaries and rollback criteria. No account, domain, origin or deployment setting is changed locally. Replace a scheduling-sensitive redirect deadline fixture with controlled timers and explicit request-arrival barriers. Verify that the second hop receives only the original remaining budget and that timers and sockets are cleaned up, without changing production deadlines or relaxing assertions. Verified with the publication-target npm run verify, the separate npm run test (229 tests across 36 files), npm audit --audit-level=high (0 vulnerabilities), npm run test:e2e (28 passed without retries), the publication-target rebuild and npm run audit:public (45 pages and 71 audited files with the expected base path), and git diff --cached --check. Hosted workflow execution, upload and deployment were not performed.
Update ten directly pinned packages and compatible nested releases after reviewing upstream changes, runtime requirements, peer constraints, licences and lifecycle scripts. Regenerate the lockfile without forced major overrides and verify a reproducible locked installation. Retain the supported compiler release while the linting peer range excludes its newer major, and keep runtime type definitions aligned with the documented compatibility floor. Document those holds and apply the reviewed formatter rewrite mechanically across nineteen templates. Preserve every frontmatter and browser-script body, rendered main-page text across all forty-five pages, source-data provenance, bounded local evidence processing and the static no-account and no-telemetry architecture. Verified with npm ci, npm run verify, the separate npm run test (229 tests across 36 files), npm run test:e2e (28 passed), the serial three-engine smoke suite (3 passed), npm audit --audit-level=low (0 vulnerabilities), npm audit signatures (415 verified signatures and 149 attestations), the publication-target build and public audit, installed-package runtime-floor checks, rendered-content comparison and git diff --cached --check. No push, upload or deployment was performed.
Require the latest successful main-branch push verification and analysis runs for the exact release commit, including their required jobs and latest attempts. Recheck the current main revision before building and immediately before publication, with bounded read-only metadata requests and fail-closed completeness and provenance checks. Keep the credential-bearing publication job dependency-free through a sparse guard-only checkout and native runtime execution. Refresh the paired analysis action revisions, add deterministic hostile-metadata and native-entrypoint regression coverage, and document the remaining repository governance and toolchain limitations. Defer package-manager bootstrap enforcement because the reviewed newer releases still contain reported bundled-dependency vulnerabilities; preserve application data, schemas and remote state. Verified with npm ci, npm run verify (273 tests across 37 files), npm run test:e2e (28 passed), npm audit --audit-level=low, npm audit --omit=dev --audit-level=low, npm audit signatures (415 signatures and 149 attestations), the production-target build and public-output audit, parsing all five workflow files, and git diff --cached --check. Application dependency audits reported zero vulnerabilities. Hosted checks and publication were not run.
Restore the reviewed package-manager CLI from its pinned archive and reconstruct its runtime dependencies from a separate integrity-locked graph. Replace the reported vulnerable bundled packages only through compatible owning ranges, without copying bundled modules, invoking the runner package manager, applying cross-major overrides or changing global installations. Validate registry origins, archive integrity, paths, entry types, script markers and bounded download budgets before activation. Audit the reconstructed graph and verify registry signatures before exposing its executables. Apply the shared bootstrap to every dependency-installing job, remove implicit pre-bootstrap caching and failure fallback, retain the dependency-free publication job, and keep runtime update proposals lockfile-only. Preserve public-data, privacy, source-review and application lifecycle-script boundaries. Verified with fresh native bootstrap reconstructions, a clean application reinstall, npm run verify (312 tests across 38 files), npm run test:e2e (28 passed without failures or retries), application and toolchain audits at low severity (zero vulnerabilities), application signature verification (415 packages and 149 attestations), toolchain signature verification (147 packages and 72 attestations), source freshness, five workflow YAML parses, the production-target build and public-output audit, and git diff --cached --check. Real host-archive tests reject symlinks and preserve legitimate regular-file extraction. Hosted checks and deployment remain pending.
Exclude the separately reviewed generated toolchain lockfile from prose terminology checks while preserving the exact exclusions and checks on nearby authored manifests. Include tracked and unignored new files in a deterministic, NUL-delimited inventory rooted at the repository, with a bounded inventory buffer, so pre-staging verification cannot silently omit new authored content. Add four regression tests covering generated metadata, authored-file failures before and after staging, ignored files, deduplication, unusual paths and execution from a subdirectory. Preserve upstream dependency identifiers, Australian-English requirements, dependency integrity, publication boundaries and remote state. Verified after staging with npm run verify (316 tests across 39 files), npm run test:e2e (28 passed without failures or retries), application and toolchain audits at low severity (zero vulnerabilities), application signature verification (415 signatures and 149 attestations), the production-target build and public-output audit, a clean staged-snapshot language audit, and git diff --cached --check. Hosted checks remain pending; no push, merge or deployment was performed.
Reject integrity-option suffixes in content security policy hash sources while retaining valid hashes, nonces, source-list fallbacks and effective strict candidate behaviour. Cover malformed algorithms and evidence-policy decisions. Gate strict report comparison on complete incomparable totals. Add genuine report-specific JSON, Markdown and XML test output, explicit bounded-event disclosure, shared format validation and process-level exit/output regressions. Retain the existing generated-lock language exclusion and authored-source rules. Refresh compatible static-build, lint and nested test dependencies through their owning declarations. Preserve compiler and runtime-type compatibility holds, reviewed browser-source snapshots and the separate package-manager runtime. Record licence, lifecycle-script, provenance and advisory evidence alongside provisioning probe boundaries, historical closure and deferred hardening choices. Validate 49 focused regressions, 354 unit tests across 41 files, unchanged coverage thresholds, 28 controlled browser/accessibility tests, both dependency graphs, registry provenance and the local publication-target build. Keep hosted checks, release approval, broader browser coverage and filesystem redesign separate.
Replace XML-forbidden code points and lone surrogates with one display space before escaping markup. Preserve legal Unicode and supplementary characters, including legal noncharacters, without changing report bytes, fingerprints, comparison totals or process exit decisions. Reproduce both reported noncharacters through normal evidence builders and the actual command-line output. Validate emitted bytes with a strict browser XML parser that rejects the original output, and cover all shared test-report renderers, markup characters, legal Unicode and character-range boundaries. Document the replacement policy, executed reproduction, retained historical closures and deferred Markdown and filesystem work. Preserve all dependency locks, reviewed source data, compatibility holds and workflow controls. Validate 366 unit tests across 41 files, 33 controlled browser/accessibility tests, unchanged coverage thresholds, separate application and toolchain audits, registry provenance and the local publication-target build. Hosted verification for this correction remains a separate step.
Anchor private evidence output to the checkout and validate destinations before collection. Publish complete files with an atomic no-replace operation and cover competing writers, partial writes and output aliases. Escape supplied report text, retain complete bounded comparison totals and separate toolchain activation from reconstruction so all verification gates precede executable publication. Extract the planning and evidence controllers with typed page controls, shared downloads, explicit pending states and source-age context. Extend local browser workflows, collector process diagnostics and measured safety tool coverage without changing hosted schedules. Record final local verification and remaining platform, zoom and release evidence limits.
slicedearth
deleted the
maintenance/security-repairs-and-deployment-hardening
branch
October 10, 2026 12:42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Local verification
npm run verify: 312 tests passed across 38 files; lint, formatting, strict types, generated-source/schema checks, build and repository/public/language audits passed.npm run test:e2e: 28 browser/accessibility tests passed without failures or retries.Review notes
The reconstructed runtime is project-maintained, not an unmodified upstream package-manager distribution. Native runtime, host extraction tooling and registry/signing infrastructure remain trust assumptions. The public hosting origin still does not supply project-controlled response headers and is not approved for sensitive organisation evidence.
Repository protections and private reporting are configured separately. Hosted CI/CodeQL results for this pull request remain required. Exact main-commit checks and deployment approval remain required after any future merge.
Release boundary
This pull request is opened for review only. Do not merge, enable auto-merge or deploy without renewed approval.