docs(board): close the 2026-08-25/26 remediation loops - #233
Merged
Conversation
Records the programme where this project already keeps its record, rather than starting a
second board beside it. Four rows struck, two opened, the tally re-derived.
Struck — none of these four were in the audit that started the programme; all were found
while closing it:
- CB-CI1 a stacked PR ran zero checks, which is how three conflict markers survived
review. Nothing looked; the PR page showed no red (#223)
- CB-COV1 coverage stopped tracing at the first database `await`. 1 065 statements
project-wide ran and were counted untested. TWO decisions had already been
taken on the wrong number — an audit finding of "chat.py 35%", and a gate ten
points below reality (#228, #229)
- CB-SEN1 `extra` and `contexts` were reached by neither scrubbing layer, and the
default denylist carries neither `dsn` nor `database_url`. Urgent from the
moment SENTRY_DSN was set in production (#230)
- CB-SEN2 HEROKU_SLUG_COMMIT is present-but-EMPTY on the container stack, so the Sentry
release would have been blank and attribution would have silently done
nothing. Enabling runtime-dyno-metadata was necessary and not sufficient (#231)
Opened, because both are honest gaps rather than finished work:
- CB-UX1 102 scenarios still carry a verification older than 30 days. Ordered and
computable via `--backlog`; the ceiling may fall but not rise
- CB-OPS1 worker peak memory is unverified at full load. R14/R15 went 170/2 → 0/0 and
the 02:00 CEST daily sync completed all four runs, but the 1 143 MB peak came
from a graph rebuild and no run since has done one. The quota is 1 024 MB
The audit report itself is committed. Three CHANGELOG claims cite "the 2026-08-23 audit",
and a citation to a document the repository does not hold is an assertion.
Board: 33 open F-, 76 struck, 5 open CB- = 38, matching the severity table.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XtEZboEDbEXLYrLf1owRXB
Two artefacts from the mechanical pass (`2026-08-26-audit.html` / `.json`) plus the reading it could not do (`2026-08-26-cold-audit.html`). The sidecar is committed because it exists so the NEXT audit can say what moved — this run reported "no earlier sidecar to compare against", and that is only true once. The mechanical pass found 29 findings. 28 are false and 1 is wrong, and its own profile says why: it detected `monorepo: true` and then read manifests only at the root, which has none — so `languages`, `managers` and `telemetry` all came back empty while `backend/pyproject.toml` and `frontend/package.json` sat unopened. Two probes declared themselves blind; three more were blind silently, one of them returning a finding. The 28 criticals are "a private key block is committed". Verified: 17 of 20 tree hits are test fixtures, 3 are a textarea placeholder and a `secretHint` string, and under a strict PEM test — matching END of the same kind, rejecting spans that contain code — exactly one candidate survives in the tree and none in history. `ssh-keygen -y` calls that one "invalid format". It is high-entropy filler used by `test_ssh_key_not_in_response` to prove the API never echoes a submitted key back. The reading found one thing worth acting on, and it is the shape this programme fixed yesterday: BILLING_ENABLED is set, STRIPE_SECRET_KEY is unset, and /pricing is a publicly indexable page selling plans the deployment cannot charge for. Checkout degrades honestly to 400 but shows a customer "Stripe is not configured (STRIPE_SECRET_KEY missing)". `capability_report.py` makes three claims and this is not one of them. Board rows are proposed in the report, not written. This audit is read-only. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XtEZboEDbEXLYrLf1owRXB
A-6 — `main` is not protected (`branches/main/protection` → 404). #223 made CI run on every pull request; nothing makes the result binding, so a PR can merge with failing or absent checks, as every merge in this programme did. A gate that runs and cannot block is a gate an operator believes in. A-7 — GitHub has dispatched no workflow for 16 hours and this PR gets none: 0 check-runs across `opened`, `reopened` and `synchronize`, while Actions is enabled, the workflow is active, and the same file dispatched correctly hours earlier. Not diagnosed and stopped deliberately — the hypothesis that fits is an org Actions limit, and reading that needs a scope this session does not have. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XtEZboEDbEXLYrLf1owRXB
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Records the programme where this project already keeps its record, rather than starting a second board beside it — a fourth copy of the truth nobody maintains is worse than none.
Four struck, and none of them were in the audit that started this
CB-CI1ci.ymlfiltered pull requests by base branch, so #218 was never measured over its whole life — which is how three raw conflict markers survived review. Nothing looked, and the PR page showed no red (#223)CB-COV1await. 1 065 statements project-wide ran and were counted untested. Two decisions had already been taken on the wrong number: an audit finding of "chat.py 35%", and afail_undergate ten points below reality (#228, #229)CB-SEN1extraandcontextswere reached by neither scrubbing layer, and the default denylist carries neitherdsnnordatabase_url. Urgent from the momentSENTRY_DSNwas set in production (#230)CB-SEN2HEROKU_SLUG_COMMITis present-but-empty on the container stack, so the Sentry release would have been blank and attribution would have silently done nothing. Enablingruntime-dyno-metadatawas necessary and not sufficient (#231)Two opened, because they are gaps rather than finished work
CB-UX1— 102 scenarios still carry a verification older than 30 days. Ordered and computable (--backlog); the ceiling may fall, never rise.CB-OPS1— worker peak memory is unverified at full load. R14/R15 went 170/2 → 0/0, and the 02:00 CEST daily sync completed all four runs with zero reaps. But the 1 143 MB peak came from a graph rebuild over 25 421 symbols, and no run since has done one — the index has been incremental. The quota is 1 024 MB, so the question is open.The report is committed
Three
CHANGELOGentries cite "the 2026-08-23 audit". A citation to a document the repository does not hold is an assertion, so the report is now indocs/reports/and linked from the board — including the part that says two of its own numbers were measurement artefacts.Board tally re-derived: 33 open
F-, 76 struck, 5 openCB-= 38, matching the severity table. The tally ratchet from #218 verified it.🤖 Generated with Claude Code
https://claude.ai/code/session_01XtEZboEDbEXLYrLf1owRXB