docs(06-11): complete post-gap security review plan

.planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-11-SUMMARY.md

@@ -0,0 +1,114 @@
+---
+phase: 06-http-routing-auth-groups-and-rate-limiting
+plan: 11
+subsystem: security
+tags: [asvs, threat-model, rate-limiting, ssrf, panic-recovery, php-parity]
+
+requires:
+  - phase: 06-http-routing-auth-groups-and-rate-limiting
+    provides: Plans 06-07 through 06-10 corrective code, adversarial tests, and passing repository gates
+provides:
+  - Post-gap ASVS L1 review covering all Phase 6 implementation plans
+  - Evidence-backed closure of T-06-23 through T-06-27
+  - Internally consistent 26-closed, zero-open Phase 6 threat verdict
+affects: [phase-07-user-plugin, phase-08-oauth, phase-12-api-routes, phase-14-integrations]
+
+tech-stack:
+  added: []
+  patterns:
+    - Security verdicts are published only after complete race and vet gates pass in both repositories
+    - Threat rows cite concrete source identifiers and slash-qualified adversarial test names
+
+key-files:
+  created:
+    - .planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-11-SUMMARY.md
+  modified:
+    - .planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-SECURITY-REVIEW.md
+
+key-decisions:
+  - "Retain all four earlier accepted risks unchanged; the five corrective threats are mitigated, not accepted or deferred"
+  - "Record anonymous inline identity only as inline:domainless|<ClientIP>, explicitly excluding policy text and request/forwarded Host inputs"
+
+patterns-established:
+  - "Post-gap security review: exact repository gates, source assertions, threat-row uniqueness, findings, totals, and audit history must all agree before zero-open status"
+
+requirements-completed: [HTTP-03, HTTP-04, HTTP-05, HTTP-06, HTTP-07, HTTP-08, HTTP-09]
+
+duration: 12h 30m elapsed
+completed: 2026-09-21
+---
+
+# Phase 6 Plan 11: Post-Gap ASVS Security Review Summary
+
+**Phase 6 now has an evidence-backed ASVS L1 verdict covering all corrective work, with 26 threats closed, zero open, and four unchanged accepted risks.**
+
+## Performance
+
+- **Duration:** 12h 30m elapsed, including the stalled executor and inline recovery
+- **Started:** 2026-09-20T22:32:00Z
+- **Completed:** 2026-09-21T11:02:51Z
+- **Tasks:** 1
+- **Files modified:** 1 review artifact plus this summary
+
+## Accomplishments
+
+- Re-ran `go test ./... -count=1 -race -short` and `go vet ./...` successfully in both `summercms.go` and sibling `fonoteka.go` before publishing the verdict.
+- Added unique threat-register rows and detailed findings for atomic limiter admission, domainless anonymous keys, NAT64/6to4 SSRF defense, transactional panic recovery, and exact InvScope denial bytes.
+- Preserved all earlier threat evidence, accepted-risk rationales, and audit history while updating the scope, totals, trust boundaries, accepted-risk count, and post-gap audit entry.
+- Verified all four declared key links and the exact T-06-24 source/test assertions, including explicit exclusion of throttle parameters and request/forwarded Host inputs.
+
+## Task Commits
+
+1. **Task 1: Re-run Phase 6 security gates and publish the post-gap threat verdict** - `829e998` (docs)
+
+**Plan metadata:** this summary commit
+
+## Files Created/Modified
+
+- `.planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-SECURITY-REVIEW.md` - Current ASVS L1 threat register, findings, verified gates, accepted risks, and audit trail.
+- `.planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-11-SUMMARY.md` - Execution evidence and phase-readiness handoff.
+
+## Decisions Made
+
+- The successful register remains at 26 total / 26 closed / 0 open, with T-06-23 through T-06-27 all closed as mitigations and no new accepted risk.
+- T-06-24 documents the anonymous signature only as `inline:domainless|<ClientIP>` and cites the Host-rotation, cross-inline-policy shared-budget, and authenticated-principal isolation regressions by exact test name.
+- The stale `06-VERIFICATION.md` was deliberately left untouched for the phase verifier to regenerate independently.
+
+## Deviations from Plan
+
+None - the plan's required artifact, repository gates, threat evidence, and acceptance assertions were completed as specified.
+
+## Issues Encountered
+
+- The first Plan 06-11 executor stopped making progress after editing the review and produced neither a commit nor a summary. The executor was paused after the configured stall threshold, and the user selected inline completion. The partial edit was reconciled against every mandatory source file, both authoritative repository gates were rerun, dates were refreshed, and only then was the review committed.
+
+## User Setup Required
+
+None - no external service configuration required.
+
+## Verification
+
+- `summercms.go`: `go test ./... -count=1 -race -short` - pass.
+- `summercms.go`: `go vet ./...` - pass.
+- `fonoteka.go`: `go test ./... -count=1 -race -short` - pass.
+- `fonoteka.go`: `go vet ./...` - pass.
+- Five new threat rows and five detailed findings are each unique, mitigated, and tied to executed evidence.
+- `gsd-sdk query verify.key-links .../06-11-PLAN.md` - 4/4 verified.
+- `06-VERIFICATION.md` remained unmodified.
+
+## Next Phase Readiness
+
+- All eleven Phase 6 plans are implemented and documented.
+- The refreshed security review is ready for final code review, regression, drift, and phase-goal verification gates.
+- No Plan 06-11 blockers remain.
+
+## Self-Check: PASSED
+
+- FOUND: `06-SECURITY-REVIEW.md` and task commit `829e998`.
+- PASS: both repositories' complete race and vet gates.
+- PASS: all Plan 06-11 acceptance assertions and all four key links.
+- PASS: 26 total / 26 closed / 0 open, four accepted risks, and preserved prior audit history.
+
+---
+*Phase: 06-http-routing-auth-groups-and-rate-limiting*
+*Completed: 2026-09-21*