From 18a4ceabd23ee49c3f40174652ea363be345215b Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Mon, 12 Oct 2026 00:18:52 +0200 Subject: [PATCH] docs(14.2): record code review disposition --- .../14.2-REVIEW-DISPOSITION.md | 118 ++++++++++++++++++ 1 file changed, 118 insertions(+) create mode 100644 .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-REVIEW-DISPOSITION.md diff --git a/.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-REVIEW-DISPOSITION.md b/.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-REVIEW-DISPOSITION.md new file mode 100644 index 0000000..66f3bb6 --- /dev/null +++ b/.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-REVIEW-DISPOSITION.md @@ -0,0 +1,118 @@ +--- +phase: 14.2 +review: 14.2-REVIEW.md +titles: json +findings: + - id: WR-01 + severity: warning + disposition: open + title: "Access log writes share and invitation tokens for 405 and 404 responses on token routes" + - id: WR-02 + severity: warning + disposition: open + title: "499 remap hides real server errors whenever the client has gone away" + - id: WR-03 + severity: warning + disposition: open + title: "Uploads route serves the stored content type verbatim on the app origin (stored XSS via text/html)" + - id: WR-04 + severity: warning + disposition: open + title: "`storage.uploads.public_path_prefix` is not validated: a non-path prefix either fails boot or silently 404s every upload" + - id: WR-05 + severity: warning + disposition: open + title: "`fonoteka:dev-seed` takes over existing accounts and tokens behind a single environment-name gate" + - id: WR-06 + severity: warning + disposition: open + title: "Minted API token secret persisted to a group/world-readable file and echoed into Playwright output" + - id: WR-07 + severity: warning + disposition: open + title: "Phase gate `--e2e` can verify a stale binary" + - id: WR-08 + severity: warning + disposition: open + title: "go.log 5xx scan passes when the access log is off" + - id: WR-09 + severity: warning + disposition: open + title: "Realtime spec accepts any publication on the channel, including another spec's" + - id: IN-01 + severity: info + disposition: open + title: "Env file parser exports arbitrary keys, so \"never executed\" is not quite true" + - id: IN-02 + severity: info + disposition: open + title: "Postgres loopback check can be bypassed by `hostaddr` or a query `host`" + - id: IN-03 + severity: info + disposition: open + title: "`down` signals recorded process groups without checking they are still this stack's" + - id: IN-04 + severity: info + disposition: open + title: "Seed validates `DEV_SEED_API_TOKEN` only after writing cover blobs, leaving orphans on refusal" + - id: IN-05 + severity: info + disposition: open + title: "Seed's token \"unchanged\" check ignores expiry and scopes" + - id: IN-06 + severity: info + disposition: open + title: "`marker_ok` does not check the app name" + - id: IN-07 + severity: info + disposition: open + title: "statusRecorder records a 1xx informational status as the final status" + - id: IN-08 + severity: info + disposition: open + title: "Gate header overstates what the whole-suite Go runs check" + - id: IN-09 + severity: info + disposition: open + title: "Hard-coded absolute developer path in a framework script" + - id: IN-10 + severity: info + disposition: open + title: "Search spec relies on the \"other\" album appearing on the first page after clearing" + - id: IN-11 + severity: info + disposition: open + title: "Test cleanups ignore errors; `goDir` mis-resolves a relative `E2E_GO_BIN`" +open: 20 +total: 20 +recorded: 2026-10-11T22:18:52.299Z +--- + +# Phase 14.2: Code Review Disposition + +| Finding | Severity | Disposition | Source | +|---------|----------|-------------|--------| +| WR-01 | warning | open | - | +| WR-02 | warning | open | - | +| WR-03 | warning | open | - | +| WR-04 | warning | open | - | +| WR-05 | warning | open | - | +| WR-06 | warning | open | - | +| WR-07 | warning | open | - | +| WR-08 | warning | open | - | +| WR-09 | warning | open | - | +| IN-01 | info | open | - | +| IN-02 | info | open | - | +| IN-03 | info | open | - | +| IN-04 | info | open | - | +| IN-05 | info | open | - | +| IN-06 | info | open | - | +| IN-07 | info | open | - | +| IN-08 | info | open | - | +| IN-09 | info | open | - | +| IN-10 | info | open | - | +| IN-11 | info | open | - | + +Dispositions: `open` (recorded, not yet triaged), `fixed`, `skipped`, `deferred`. +Set `deferred` by hand and put the reason in the Source cell; both are preserved. A `|` in the reason is kept as prose and escaped on the next run. +Re-running the gate keeps every row it can. A row the current review no longer reports is kept and its Source cell flagged, so a finding does not leave this record silently. ONE exception: when a finding id is REUSED by a different finding, the earlier decision cannot keep a row — the id is taken — and it is dropped. A RECORDED decision (anything but `open`) is named on the console when that happens; a row still at `open` is replaced silently, because `open` records no decision to lose.