peter
4aaaaa7860
The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").
Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.
Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).
One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.
16 lines
802 B
YAML
16 lines
802 B
YAML
# The CVE gate's allowlist. The publish gate scans the built image and the committed tree with
|
|
# Trivy and fails on any HIGH or CRITICAL finding that has a fix available. A finding that cannot be
|
|
# fixed yet is let through ONLY by an entry here, and every entry carries both:
|
|
# statement — why it is acceptable for now (what is exposed, what is not)
|
|
# expired_at — the date it stops being accepted; after it, the gate fails again on its own
|
|
# A contract test (frontend/src/lib/gates.contract.test.ts) refuses an entry without either, and
|
|
# docs/gates.md lists them.
|
|
#
|
|
# Example:
|
|
# vulnerabilities:
|
|
# - id: CVE-2026-00000
|
|
# statement: in libfoo's XML path, which nothing in the image calls; no fixed Debian build yet
|
|
# expired_at: 2026-12-31
|
|
vulnerabilities: []
|
|
secrets: []
|