Jakub Zych
3aed5c88c3
docs(07): revise plans after checker review
2026-09-22 12:37:08 +02:00
Jakub Zych
57745e32a2
docs(07): create phase plan
...
Six plans for the user plugin and authentication phase:
- 07-01: bouncer JWT lifecycle, password hashing, I18N-02 locale
override, lagoon.Validate extensions (summercms.go)
- 07-02: User/Throttle schema, core session loop (login/logout/
fetch/refresh/register) (fonoteka.go)
- 07-03: account management (forgot/reset, activation, update,
change-password, avatar, mail) (fonoteka.go)
- 07-04: personal API tokens, me/locale, 423-exempt route-table
proof (fonoteka.go)
- 07-05: parity evidence recording against the isolated PHP
instance (fonoteka.go)
- 07-06: full unit coverage and validation sign-off (both repos)
Plan count and scope confirmed at the plan-count checkpoint.
2026-09-22 12:21:15 +02:00
Jakub Zych
0c41151863
docs(07): add pattern map
2026-09-22 11:51:06 +02:00
Jakub Zych
fb16132d21
docs(07): add validation strategy
2026-09-22 02:43:29 +02:00
Jakub Zych
0ef3a47d22
docs(07): research user plugin and authentication phase
2026-09-22 02:42:14 +02:00
Jakub Zych
1979c45083
docs(07): capture phase context
2026-09-22 00:24:21 +02:00
Jakub Zych
2fe5c1e920
docs(06): verify phase 6 passed, mark HTTP-04/06 complete
2026-09-21 19:51:58 +02:00
Jakub Zych
fb66398cb9
docs(06-14): complete gap-closure test and review plan
2026-09-21 19:49:47 +02:00
Jakub Zych
ae817ccbb9
docs(06-14): reopen and re-close phase 6 security review with T-06-28..35
2026-09-21 19:49:30 +02:00
Jakub Zych
54dd60953a
docs(06-13): complete fetchguard SSRF gap-closure plan
2026-09-21 19:45:03 +02:00
Jakub Zych
4bad1a43a2
docs(06-12): complete surf/bouncer gap-closure plan
2026-09-21 19:43:51 +02:00
Jakub Zych
46c7e4f98e
docs(06): create gap-closure plans 12-14
2026-09-21 19:30:50 +02:00
Jakub Zych
6e9188b5c7
docs(06): record verification gaps
2026-09-21 14:49:52 +02:00
Jakub Zych
c5b412c7e1
docs(06): add code review report
2026-09-21 14:31:47 +02:00
Jakub Zych
2329e1f290
docs(06-11): complete post-gap security review plan
2026-09-21 13:03:41 +02:00
Jakub Zych
829e9989e3
docs(06-11): refresh Phase 6 security review
2026-09-21 13:02:41 +02:00
Jakub Zych
943be2353d
docs(06-10): complete exact InvScope denial bodies plan
2026-09-21 00:26:51 +02:00
Jakub Zych
158df899f6
docs(06-09): complete transactional panic recovery plan
...
Tasks completed: 1/1
- Buffer route responses so panic recovery can discard partial output
SUMMARY: .planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-09-SUMMARY.md
2026-09-20 21:06:51 +02:00
Jakub Zych
ac24ddd518
docs(06-08): complete transition-address SSRF closure plan
...
Tasks completed: 1/1
- Decode and reclassify embedded IPv4 at the dial-time SSRF boundary
SUMMARY: .planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-08-SUMMARY.md
2026-09-20 20:58:54 +02:00
Jakub Zych
bc43e9eabd
docs(06-07): complete atomic limiter admission plan
...
Tasks completed: 1/1
- Make fixed-window admission atomic and inline keys server-controlled
SUMMARY: .planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-07-SUMMARY.md
2026-09-20 17:10:43 +02:00
Jakub Zych
47e9c44b2a
docs(06): create gap closure plans
2026-09-20 16:14:21 +02:00
Jakub Zych
dd78e0d6b3
docs(06): record gap-closure re-verification
2026-09-20 13:57:07 +02:00
Jakub Zych
067a3ffb2b
docs(06): add code review report
2026-09-20 13:49:19 +02:00
Jakub Zych
7f627961b1
docs(06-06): complete personal-token rate-limit gap plan
2026-09-20 13:31:41 +02:00
Jakub Zych
3423da2222
docs(06-06): extend security review through gap closure
2026-09-20 13:30:41 +02:00
Jakub Zych
b20466d2e2
fix(06): revise gap plan security coverage and full gates
2026-09-20 00:14:58 +02:00
Jakub Zych
a61c83e614
fix(06): resolve research questions
2026-09-19 23:13:24 +02:00
Jakub Zych
2f90fef830
docs(06): add rate-limit middleware gap plan
2026-09-19 23:07:43 +02:00
Jakub Zych
59d9a26aad
docs(phase-06): record verification gaps and reopen phase
2026-09-19 21:44:26 +02:00
Jakub Zych
73218c0781
docs(06): add code review report
2026-09-19 21:32:41 +02:00
Jakub Zych
b759669f23
docs(06-05): complete unit coverage and security-review plan
2026-09-19 21:21:42 +02:00
Jakub Zych
74d1eb37a0
docs(06-05): map every T-06-xx threat to a passing test or restated accept
...
- 19-row register T-06-01 through T-06-18 plus T-06-SC
- mitigate rows name file:TestName; accept rows copy originating rationale
- grep: no bearer/hash logging; inv.must-change-password only in HouseMiddlewares
2026-09-19 21:15:24 +02:00
Jakub Zych
f61776d0a6
docs(06-03): complete raw groups, wire, CORS, and body-limit plan
...
- Operator-confirmed 128MiB body limits (134217728); D-18/T-06-13 closed
- HTTP-06, HTTP-08, HTTP-09 marked complete
2026-09-19 21:01:07 +02:00
Jakub Zych
42b8295cc1
docs(06-02): complete fixed-window limiter and five-bucket plan
2026-09-19 19:46:28 +02:00
Jakub Zych
bc17c3decb
chore: merge executor worktree (worktree-agent-01a0ba96)
2026-09-19 19:26:53 +02:00
Jakub Zych
1f56a9ee1c
docs(06-01): complete guard registry and dual-group genres plan
2026-09-19 19:24:03 +02:00
Jakub Zych
cca4ec3a8b
docs(06-04): complete SSRF-guarded fetch helper plan
...
- Record fetchguard.Fetch dial-time SSRF helper, typed reasons, and TDD commits
2026-09-19 19:03:20 +02:00
Jakub Zych
ecab09c37a
docs(06): finalize phase plan after verification
2026-09-19 17:16:58 +02:00
Jakub Zych
ad3d6f7f84
docs(06): revision pass 1 - resolve Limiter naming collision and add plugin-facing house-middleware capability
2026-09-19 17:13:02 +02:00
Jakub Zych
c4f406bb64
docs(06): create phase plan
2026-09-19 16:58:48 +02:00
Jakub Zych
6a9f5e1b47
docs(05): add code review fix report
2026-09-19 15:41:27 +02:00
Jakub Zych
c0b2b6db08
docs(phase-6): add validation strategy
2026-09-19 15:36:23 +02:00
Jakub Zych
e9c2f25ebe
docs(06): research HTTP routing, auth groups and rate limiting
2026-09-19 15:35:20 +02:00
Jakub Zych
820d17c6c3
docs(06): capture phase context
2026-09-19 14:04:36 +02:00
Jakub Zych
ab4ac856da
docs(05): add code review report
2026-09-19 00:20:17 +02:00
Jakub Zych
bbee45c5f4
docs(05): add code review fix report
2026-09-18 23:53:21 +02:00
Jakub Zych
0056c35cb0
docs(phase-5): complete phase execution
2026-09-18 21:11:43 +02:00
Jakub Zych
cd546dae1d
docs(05): add code review report
2026-09-18 21:11:11 +02:00
Jakub Zych
ba3efccadd
docs(05-06): complete fill-fuzz hidden-marshal security-review plan
...
- Record fuzz, hidden-marshal, public_token, attach, and security-review outcomes
- Note module-boundary placement of the models.All() walk
2026-09-18 20:54:10 +02:00
Jakub Zych
e0a11c3ea0
docs(05-06): security review of fill and encryption boundaries
...
- Map T-05-01 through T-05-24 to a passing test or restated accept rationale
- Enumerate every .Reveal() call site; none are on log or serialize paths
- Confirm zero AutoMigrate production calls and no Association Mode pivot writes
2026-09-18 20:51:35 +02:00
