Fases 4–5 external audit round + release-truthfulness remediation - #53
Merged
Conversation
Archive the Fase-3 audit round to `-fase-3` suffix (matching the `-fase-1` precedent) and generate the unified audit prompt for the Fases 4–5 phase-scoped round. Scope: packaging (Flatpak manifest, lnxdrive.spdx, metainfo/AppStream, packaging README) + release infrastructure (release.yml, SECURITY.md, CHANGELOG.md, README install section, version unification 0.1.0-alpha.1). Range 31482c7..ae5a27d (PRs #48+#49, already on main — the default origin/main..HEAD would under-cover). Focus: Flatpak sandbox permission posture vs RISK-002, release/supply-chain pipeline, SPDX correctness. Charter Fase-3 reference updated review.md → review-fase-3.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
CHARTER-01 is multi-phase and has multiple external-audit rounds, but StrayMark's audit tooling assumes one round per Charter (fixed flat paths; non-recursive `report-*.md` glob). The `-fase-N` suffix workaround left every round's files flat in one folder and — worse — let the review/merge glob pick up prior rounds' reports (a latent correctness bug that would have polluted the Fases 4–5 review/telemetry). Archive closed rounds into per-round subfolders with canonical names: fase-1/ (security: RISK-002, CI hardening) fase-3/ (GTK4 preferences panel) The current Fases 4–5 round stays flat so the CLI/skills find it and the non-recursive glob sees only it. Charter/phase-level analysis docs (phase-3-gtk4-panel-audit.md, upstream-feedback-drafts.md) stay flat — they're referenced by immutable AILOG/AIDEC records. README.md documents the convention as an adopter stopgap pending native per-round namespacing upstream (relates to straymark#208). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ledger Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3 heterogeneous auditors (gemini-3.1-pro-high, gpt-5-codex, qwen3.7-plus) over range 31482c7..ae5a27d. Disjoint finding sets, no contamination. Calibrator (claude-opus-4-8) verified all 7 auditor findings VALID (0 false positives / 0 misattributions) and found 1 missed-by-all → 8 consolidated. Blocking: H1 (High) — README quick start presents `pin`/`dehydrate` stubs as working offline/space-freeing actions. Plus 2 Medium release-truthfulness copy defects (M1 session-handle docs; missed-by-all metainfo <release> overstating bundle contents). M2 id alignment + RD-1..4 metadata/date debt. All fixes copy/metadata-only; wiring deferred to v0.2. review.md has verdicts, remediation plan, auditor ratings (gpt-5-codex 9.2 / qwen 7.0 / gemini 4.6). external-audit-pending.yaml holds the schema-validated telemetry block for Charter close. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Audit round (3 auditors) found 1 High + 2 Medium release-truthfulness defects where public copy described behaviour/features the alpha does not deliver. All fixes are copy/metadata; the underlying code work is deferred to v0.2. - H1 (High): README quick start presented `pin`/`dehydrate` stubs as working offline/space-freeing actions — removed from the runnable block and marked not-yet-functional (they report without changing state). - M1 (Medium): SECURITY.md + CHANGELOG claimed the D-Bus API exposes "opaque session handles" — a design that drifted and was never shipped. Reworded to the real GOA-object-path → success/account-state contract. - Missed-by-all (Medium): metainfo <release> advertised Shell indicator + Nautilus overlays + GOA as bundle contents; the Flatpak excludes all three. Reworded to what the bundle actually ships. - RD-1 (Low): lnxdrive-gnome/Cargo.toml repository URL → monorepo. - Erratum on AILOG-2026-06-04-002 "comandos reales" claim. Deferred to follow-ups FU-007..FU-012 (pin/dehydrate/hydrate FUSE-IPC wiring = v0.2 TDE candidate; M2 app-id/AppStream id alignment = v0.2; RD-2 git dep; RD-3/RD-4 = Fase-6 tag-time date/link updates). AILOG-2026-07-03-001. straymark validate: 0 errors. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
# Conflicts: # .straymark/follow-ups-backlog.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third external-audit round of Charter-01 (fases-4-5: Flatpak packaging + release infrastructure, range
31482c7..ae5a27d) plus the remediation of its findings.Audit
3 heterogeneous auditors — gemini-3.1-pro-high, gpt-5-codex, qwen3.7-plus — produced disjoint finding sets (no contamination). The calibrator (claude-opus-4-8) verified all 7 auditor findings VALID (0 false positives, 0 misattributions) and found 1 the three missed → 8 consolidated. Full analysis in
review.md; auditor ratings gpt-5-codex 9.2 / qwen 7.0 / gemini 4.6.The blocking finding (H1, High) and two Mediums were release-truthfulness defects — public copy describing behaviour/features the alpha does not deliver — not code bugs.
Remediation (copy + metadata only)
pin/dehydrateas working; marked not-yet-functional (they report without changing FUSE state)SECURITY.md+CHANGELOG.md: dropped the "opaque session handles" claim (design drifted, never shipped) → real GOA-object-path → success/account-state contract<release>no longer advertises Shell indicator + Nautilus overlays + GOA as bundle contents (the Flatpak excludes all three)lnxdrive-gnome/Cargo.tomlrepository URL → monorepoNo production code changed — the CLI FoD command wiring (H1 root cause) needs FUSE IPC and is deferred to v0.2.
Deferred → follow-ups registry
FU-007pin/dehydrate/hydrate FUSE-IPC wiring (v0.2 TDE candidate) ·FU-008M2 app-id/AppStream/GSettings-schema id alignment (v0.2/Flathub, needs build validation) ·FU-009RD-2 git dep ·FU-010/FU-011RD-3/RD-4 tag-time date+link updates (Fase 6 checklist).Audit-folder housekeeping (also in this PR)
Closed rounds archived into per-round subfolders (
fase-1/,fase-3/); current round flat. Fixes a latentreport-*.mdglob-pollution bug and declutters the folder. Convention documented in.straymark/audits/CHARTER-01/README.md; upstream issue filed as straymark#341.Notes for merge
external-audit-pending.yaml..straymark/follow-ups-backlog.md, as does fix(config): correct daemon Exec path lnxdrive-daemon → lnxdrived #52 — expect a minor counter conflict in the frontmatter; resolve withstraymark followups recountafter both merge.straymark validate: 0 errors.🤖 Generated with Claude Code