---
phase: 11.2
review: 11.2-REVIEW.md
updated: 2026-10-01T14:49:40Z
---

# Phase 11.2 code review disposition

One row per finding in 11.2-REVIEW.md. Default `open`; set to `fixed`, `accepted` or `deferred` with a note.

| ID | Severity | Finding | Disposition | Note |
|----|----------|---------|-------------|------|
| CR-01 | critical | The install root is owned by the service account, so root's deploy steps can be redirected through symlinks | open | |
| WR-01 | warning | The HTTPS server block sends no Strict-Transport-Security header | open | |
| WR-02 | warning | The HTTP block redirects ACME challenges, and the app 404s `/.well-known/` | open | |
| WR-03 | warning | The D-40 terminal check puts GOBIN on PATH, so it does not prove the page's commands work in a fresh shell | open | |
| WR-04 | warning | The site test gate and the `pnpm test` script only work on Node 22.18 to 22.x | open | |
| WR-05 | warning | The smoke script can test a different server that already holds the port | open | |
| WR-06 | warning | A release build does not compile what its plugin tests checked, and does not require clean submodules | open | |
| IN-01 | info | The extension-less docs 301 drops the query string | open | |
| IN-02 | info | `site_label` in site.yaml cannot be paired with `--site-url` alone | open | |
| IN-03 | info | The og:image alt text is not reactive, unlike the other SEO fields | open | |
| IN-04 | info | Copy-button failures are silent and success is not announced | open | |
| IN-05 | info | The gate's built stage can check one framework checkout and build from another | open | |
| IN-06 | info | Pipelines in an assignment exit under `set -e` without a diagnostic | open | |
| IN-07 | info | The external link check follows redirects, so a login redirect would count as a pass | open | |
| IN-08 | info | The scroll-spy section list is defined twice | open | |

open: 15 of 15