---
phase: 11.2
review: 11.2-REVIEW.md
updated: 2026-10-01T14:49:40Z
---

# Phase 11.2 code review disposition

One row per finding in 11.2-REVIEW.md. Default `open`; set to `fixed`, `accepted` or `deferred` with a note.

| ID | Severity | Finding | Disposition | Note |
|----|----------|---------|-------------|------|
| CR-01 | critical | The install root is owned by the service account, so root's deploy steps can be redirected through symlinks | fixed | sm-summercmsio-app 8e5765e |
| WR-01 | warning | The HTTPS server block sends no Strict-Transport-Security header | fixed | sm-summercmsio-app 1dcf774 (no includeSubDomains; check on rome) |
| WR-02 | warning | The HTTP block redirects ACME challenges, and the app 404s `/.well-known/` | fixed | sm-summercmsio-app 1e934ab (webroot path to check on rome) |
| WR-03 | warning | The D-40 terminal check puts GOBIN on PATH, so it does not prove the page's commands work in a fresh shell | accepted | user chose option 1: card unchanged, PATH step added to the installation guide (summercms.go bd2f7e7) |
| WR-04 | warning | The site test gate and the `pnpm test` script only work on Node 22.18 to 22.x | fixed | vue-summercmsio-app 60c3c4a, summercms.go be51bfe, sm-summercmsio-app aeac7bf |
| WR-05 | warning | The smoke script can test a different server that already holds the port | fixed | sm-summercmsio-app 8cfe055 |
| WR-06 | warning | A release build does not compile what its plugin tests checked, and does not require clean submodules | fixed | sm-summercmsio-app fffa38c |
| IN-01 | info | The extension-less docs 301 drops the query string | open | |
| IN-02 | info | `site_label` in site.yaml cannot be paired with `--site-url` alone | open | |
| IN-03 | info | The og:image alt text is not reactive, unlike the other SEO fields | open | |
| IN-04 | info | Copy-button failures are silent and success is not announced | open | |
| IN-05 | info | The gate's built stage can check one framework checkout and build from another | open | |
| IN-06 | info | Pipelines in an assignment exit under `set -e` without a diagnostic | open | |
| IN-07 | info | The external link check follows redirects, so a login redirect would count as a pass | open | |
| IN-08 | info | The scroll-spy section list is defined twice | open | |

fixed: 6, accepted: 1, open: 8 of 15 (IN-01..IN-08, info, out of fix scope)