diff --git a/audit/.lane-c01/C01.md b/audit/.lane-c01/C01.md index c5ee0364..d43a7f92 100644 --- a/audit/.lane-c01/C01.md +++ b/audit/.lane-c01/C01.md @@ -1,5 +1,5 @@ CLUSTER_START cluster=C01 repo=SessionLedger pillars=L10-L19 date=2026-07-14 -# Wave-27 reaudit tip 114428a (#227-#232) +# Wave-32 reaudit tip 776910b (#266-#271) ### L10 — CI/CD Hygiene score: 3 glyph: ✓ @@ -82,14 +82,17 @@ gaps: soft_goal_delta: +95% toward polished CLI UX (completions + help examples landed Wave-27 #230; score held at pillar max) ### L16 — Internationalization (i18n / l10n) -score: 0 glyph: ✗ +score: 1 glyph: ~ evidence: - - MISSING: gettext/fluent/i18n crates or locale catalogs (grep returned no i18n framework) - - crates/sl-viewer/src/theme.rs:7-8 — English-only UI strings inline - - README.md:1-44 — English-only docs + - locales/en.json — Phase-0 English JSON catalog with required keys (#269) + - src/i18n.rs — catalog lookup helper (`t` / `try_catalog`) (#269) + - docs/ops/i18n.md — English-only posture + future Fluent/ICU hooks (#269) + - scripts/i18n-check.ps1 — hermetic SelfCheck for catalog + module anchors (#269) + - tests/i18n.rs — cargo test wrapper for SelfCheck (#269) + - MISSING: Fluent/ICU multi-locale catalogs; viewer string migration beyond stub gaps: - - Not started; add fluent/ICU if multi-locale becomes a goal — effort: L -soft_goal_delta: not started + - Expand beyond English stub; wire Fluent/ICU if multi-locale becomes a goal — effort: L +soft_goal_delta: +20% — Phase-0 locale catalog + lookup helper Wave-32 #269; multi-locale unpaid ### L17 — Accessibility (a11y) score: 3 glyph: ✓ @@ -141,5 +144,6 @@ Wave-21: L10 CI concurrency + auxiliary SHA pins (#185); L15 CLI exit-code polis Wave-24: L18 .env.example + env-example CI gate + rotation docs (#201); L18 +1. Wave-26: L10 quality-gate.yml commit-SHA pin (#225); score held — L10 already pillar max. Wave-27: L15 clap completions + richer help (#230); score held — L15 already pillar max. -CLUSTER_TOTAL score=27/30 pct=90% grade=A +Wave-32: L16 i18n scaffold / locale catalog stub (#269); L16 +1 (0→1; Fluent/ICU unpaid). +CLUSTER_TOTAL score=28/30 pct=93% grade=A CLUSTER_DONE cluster=C01 repo=SessionLedger diff --git a/audit/.lane-c04/C04.md b/audit/.lane-c04/C04.md index f6d0ef91..bfe5070e 100644 --- a/audit/.lane-c04/C04.md +++ b/audit/.lane-c04/C04.md @@ -1,5 +1,5 @@ CLUSTER_START cluster=C04 repo=SessionLedger pillars=L31-L40 date=2026-07-14 -# Wave-31 reaudit tip a7d1a8e (#259-#264) +# Wave-32 reaudit tip 776910b (#266-#271) ### L31 — Secrets in repo score: 3 glyph: ✓ @@ -123,14 +123,16 @@ evidence: - Containerfile:1-11 — multi-stage rust→debian image for sl-daemon - .github/workflows/ci.yml:15 — ubuntu-latest hosted runner; no privileged: true - .github/workflows/security.yml:11-12 — permissions: contents: read (least privilege) - - docs/ops/sandbox-boundary.md — sandbox boundary checklist SSOT (USER/VOLUME/loopback/least-priv) (#255) - - scripts/sandbox-boundary-check.ps1 — hermetic SelfCheck for Containerfile + trust-boundary anchors (#255) + - docs/ops/sandbox-boundary.md — sandbox boundary checklist + soft seccomp/no-net operator guidance (#255/#268) + - packaging/oci/sl-daemon-seccomp.json — checked-in seccomp deny-list sample (#268) + - packaging/oci/compose.sl-daemon.soft-hardening.yml — no-new-privileges / cap-drop ALL sample (#268) + - scripts/sandbox-boundary-check.ps1 — hermetic SelfCheck for Containerfile + seccomp/compose anchors (#255/#268) - tests/sandbox_boundary.rs — cargo test wrapper for SelfCheck (#255) - - .github/workflows/security.yml — soft `sandbox-boundary` job (`continue-on-error`) (#255) - - MISSING: seccomp profile / rootless / no-net CI sandbox policy + - .github/workflows/security.yml — soft `sandbox-boundary` job (`continue-on-error`) (#255/#268) + - MISSING: hard rootless / blocking no-net CI sandbox policy gaps: - - Add seccomp profile and documented no-net CI sandbox — effort: M -soft_goal_delta: +55% — sandbox checklist + SelfCheck Wave-30 #255; seccomp/no-net unpaid (score held) + - Make seccomp/no-net CI blocking and document hard rootless runtime — effort: M +soft_goal_delta: +70% — soft seccomp/no-net policy Wave-32 #268; hard CI unpaid (score held) Wave-15: L31 gitleaks pre-commit hook (+1). Wave-16: L31 TruffleHog dual-scan CI (#152); score held at pillar max. @@ -139,5 +141,6 @@ Wave-26: L37 Renovate + patch automerge (#220); L37 +1 (L33 gitleaks SARIF evide Wave-27: L34 branch-protection verify script (#228); score held — L34 already pillar max; L36 2FA unpaid. Wave-30: L40 sandbox boundary checklist + SelfCheck (#255); score held — seccomp/no-net unpaid; soft CI. Wave-31: L38 OSV/NVD CVE feed SSOT + SelfCheck (#259); L38 +1 (2→3). +Wave-32: L40 soft seccomp/no-net sandbox policy (#268); score held — soft CI; hard rootless/no-net unpaid. CLUSTER_TOTAL score=26/30 pct=87% grade=B CLUSTER_DONE cluster=C04 repo=SessionLedger diff --git a/audit/.lane-c05/C05.md b/audit/.lane-c05/C05.md index 58464193..0de63a02 100644 --- a/audit/.lane-c05/C05.md +++ b/audit/.lane-c05/C05.md @@ -1,5 +1,5 @@ CLUSTER_START cluster=C05 repo=SessionLedger pillars=L41-L50 date=2026-07-14 -# Wave-30 reaudit tip 27435e5 (#252-#257) +# Wave-32 reaudit tip 776910b (#266-#271) ### L41 — Structured logs score: 3 glyph: ✓ @@ -41,14 +41,14 @@ soft_goal_delta: +95% (per-route RED histogram buckets landed Wave-19 #169; OTLP ### L44 — Distributed trace propagation score: 3 glyph: ✓ evidence: - - crates/sl-daemon/src/http.rs:151-188 — validates W3C v00 traceparent IDs and rejects zero/malformed contexts - - crates/sl-daemon/src/http.rs:190-225 — records upstream trace fields on request spans and echoes valid traceparent responses - - crates/sl-daemon/src/http.rs:599-648 — parser and end-to-end HTTP propagation/counting tests - - docs/ops/observability.md:141-148 — propagation behavior and HTTP-only limitation documented - - MISSING: OpenTelemetry parent-context extraction/tracestate/baggage and propagation into worker/pipeline spans + - crates/sl-daemon/src/traceparent.rs — W3C v00 traceparent parse + helper API (#271) + - crates/sl-daemon/src/http.rs — validates upstream traceparent IDs and echoes valid response headers + - crates/sl-daemon/src/worker.rs — worker/pipeline span propagation of parsed trace context (#271) + - docs/ops/observability.md — propagation behavior + worker helper contract documented (#271) + - MISSING: OpenTelemetry parent-context extraction/tracestate/baggage and OTLP cross-process parentage gaps: - - Convert parsed headers into OTel parent context and carry context through pipeline stages — effort: M -soft_goal_delta: +60% (HTTP traceparent correlation landed; true cross-process parentage remains) + - Convert parsed headers into OTel parent context with tracestate/baggage — effort: M +soft_goal_delta: +85% — worker propagation helper Wave-32 #271; OTel parent-context unpaid (score held at pillar max) ### L45 — Continuous profiling score: 2 glyph: ~ @@ -145,5 +145,6 @@ Wave-22: L46 multi-window SLO burn rules + game-day/alert routing (#189); L46 +1 Wave-24: L45 pprof operator docs + pprof-smoke CI (#204); L45 +1. Wave-27: L45 unix CPU pprof protobuf sampler (#232); score held — continuous agent / Windows unpaid. Wave-30: L45 continuous profiling agent stub soft (#254); score held — Pyroscope/OTLP push unpaid. +Wave-32: L44 W3C traceparent worker propagation helper (#271); score held — L44 already pillar max; OTel parent-context unpaid. CLUSTER_TOTAL score=29/30 pct=97% grade=A CLUSTER_DONE cluster=C05 repo=SessionLedger diff --git a/audit/.lane-c07/C07.md b/audit/.lane-c07/C07.md index a7e86da5..ddf6b79a 100644 --- a/audit/.lane-c07/C07.md +++ b/audit/.lane-c07/C07.md @@ -1,5 +1,5 @@ CLUSTER_START cluster=C07 repo=SessionLedger pillars=L61-L70 date=2026-07-14 -# Wave-31 reaudit tip a7d1a8e (#259-#264) +# Wave-32 reaudit tip 776910b (#266-#271) ### L61 — Devcontainer / .devcontainer score: 3 glyph: ✓ @@ -86,9 +86,13 @@ evidence: - fuzz/corpus/jsonl_ingest/two_sessions.jsonl — corpus seed (#203) - fuzz/Cargo.toml — registers jsonl_ingest target (#203) - .github/workflows/ci.yml — fuzz smoke runs okf_roundtrip and jsonl_ingest (#203) + - docs/ops/fuzz-cadence.md — sustained soft fuzz cadence SSOT (#266) + - .github/workflows/fuzz-cadence.yml — scheduled/soft sustained fuzz (`continue-on-error`) (#266) + - scripts/fuzz-cadence-check.ps1 — hermetic SelfCheck for cadence anchors (#266) + - tests/fuzz_cadence.rs — cargo test wrapper for SelfCheck (#266) gaps: - - Longer-running fuzz cadence / crash corpus triage beyond PR smoke — effort: M -soft_goal_delta: +55% — two cargo-fuzz targets + CI smoke landed Wave-9/#203; sustained fuzz remains + - Longer-running crash corpus triage / blocking sustained fuzz beyond soft cadence — effort: M +soft_goal_delta: +70% — soft sustained cadence Wave-32 #266; blocking longer fuzz unpaid (score held) ### L68 — Flake detection score: 3 glyph: ✓ @@ -143,5 +147,6 @@ Wave-24: L67 jsonl_ingest fuzz target + corpus/CI (#203); L67 +1 (L66 evidence r Wave-26: enforced pipeline perf-budget gate (#223) evidence lives under C08 L74 (already pillar max); WBS-6.2 perf soft goal closed — C07 score held. Wave-30: L64 test pyramid SSOT + SelfCheck (#253); L64 +1 (2→3). Wave-31: L66 broaden property tests for lifecycle FSM (#261); L66 +1 (2→3). +Wave-32: L67 sustained fuzz cadence soft job (#266); score held — soft `continue-on-error`; blocking longer fuzz unpaid. CLUSTER_TOTAL score=29/30 pct=97% grade=A CLUSTER_DONE cluster=C07 repo=SessionLedger diff --git a/audit/.lane-c08/C08.md b/audit/.lane-c08/C08.md index 258aa147..7dc83afe 100644 --- a/audit/.lane-c08/C08.md +++ b/audit/.lane-c08/C08.md @@ -1,5 +1,5 @@ CLUSTER_START cluster=C08 repo=SessionLedger pillars=L71-L80 date=2026-07-14 -# Wave-31 reaudit tip a7d1a8e (#259-#264) +# Wave-32 reaudit tip 776910b (#266-#271) ### L71 — Eval Corpus Coverage score: 3 glyph: ✓ @@ -56,18 +56,18 @@ gaps: soft_goal_delta: +90% — enforced per-PR perf-budget SelfCheck + blocking bench-gate landed Wave-26 #223 ### L75 — Cross-Language Parity -score: 1 glyph: ~ +score: 2 glyph: ~ evidence: - Cargo.toml:1-16 — Rust workspace (session-ledger + sl-viewer); no Py/Go/TS packages - - docs/ops/cross-language-parity.md — fixture parity SSOT matrix (Python/TypeScript/Go tags) (#260) - - scripts/cross-language-parity-check.ps1 — hermetic SelfCheck for matrix fixtures + language tags (#260) + - docs/ops/cross-language-parity.md — fixture parity SSOT + OKF v1.0 structural invariant harness (#260/#267) + - scripts/cross-language-parity-check.ps1 — hermetic SelfCheck for matrix tags + shared-core structural fingerprint (#260/#267) - tests/cross_language_parity.rs — cargo test wrapper for SelfCheck (#260) - - .github/workflows/eval-compression.yml — blocking `cross-language-parity` SelfCheck job (#260) - - docs/EVAL_SCOPE.md — cross-language fixture parity in-scope; Harbor N/A retained (#260) - - MISSING: native language adapters / SDK ports beyond OKF fixture tags + - .github/workflows/eval-compression.yml — blocking `cross-language-parity` SelfCheck job (#260/#267) + - docs/EVAL_SCOPE.md — cross-language fixture + structural parity in-scope; Harbor N/A retained (#260/#267) + - MISSING: native language adapters / SDK ports beyond fixture + structural harness gaps: - - Ship language adapters or consumer harnesses beyond fixture-tag parity — effort: L -soft_goal_delta: +25% — fixture parity scaffold + blocking SelfCheck Wave-31 #260; adapters unpaid + - Ship language adapters or consumer harnesses beyond structural fixture parity — effort: L +soft_goal_delta: +50% — structural OKF invariant harness Wave-32 #267; adapters unpaid ### L76 — Agent-Eval Pipeline score: 2 glyph: ~ @@ -141,5 +141,6 @@ Wave-26: L71/L80 seventeen-fixture task-family corpus (#221); L74 enforced perf- Wave-28: L77 compression/token fixtures + eval gate (#239); L77 +1; L71 corpus 20 fixtures (held at max). Wave-29: L78 token-burn ledger smoke (#248); L78 +1. Wave-31: L75 cross-language fixture parity SSOT + SelfCheck (#260); L75 +1 (0→1; adapters unpaid). -CLUSTER_TOTAL score=27/30 pct=90% grade=A +Wave-32: L75 structural OKF invariant harness across Py/TS/Go fixtures (#267); L75 +1 (1→2; adapters unpaid). +CLUSTER_TOTAL score=28/30 pct=93% grade=A CLUSTER_DONE cluster=C08 repo=SessionLedger diff --git a/audit/.lane-c09/C09.md b/audit/.lane-c09/C09.md index cb4425b7..37293b41 100644 --- a/audit/.lane-c09/C09.md +++ b/audit/.lane-c09/C09.md @@ -1,5 +1,5 @@ CLUSTER_START cluster=C09 repo=SessionLedger pillars=L81-L95 date=2026-07-14 -# Wave-31 reaudit tip a7d1a8e (#259-#264) +# Wave-32 reaudit tip 776910b (#266-#271) ### L81.1 — WCAG 2.2 Level A Baseline score: 3 glyph: ✓ @@ -150,17 +150,19 @@ gaps: soft_goal_delta: +85% — production responsive shell + overflow/touch CI landed Wave-16 #155 ### L81.12 — Recognition Over Recall -score: 2 glyph: ~ +score: 3 glyph: ✓ evidence: - crates/sl-viewer/src/app.rs:243-295 — persistent tab bar for primary navigation - crates/sl-viewer/src/timeline.rs:156-247 — tooltip panel for selected timeline bar - crates/sl-viewer/src/command_palette.rs — Cmd+K / Ctrl+K command palette (focus search, toggle theme) (#236) - crates/sl-viewer/src/app.rs — palette wired with dialog/listbox/option roles (#236) - - tests/visual/harness/a11y.spec.js — palette a11y harness coverage (#236) + - crates/sl-viewer/src/search_view.rs — advanced Search filters collapsed behind progressive-disclosure control + active-filter badge (#270) + - docs/a11y/progressive-disclosure.md — recognition-first progressive disclosure SSOT beyond Cmd+K (#270) + - tests/visual/harness/a11y.spec.js — palette + progressive-disclosure aria-expanded/panel/badge coverage (#236/#270) - crates/sl-daemon/src/main.rs:89-90 — `sl list` surfaces compiled bundles gaps: - Wizard breadcrumbs / prefilled edit forms where multi-step flows appear — effort: S -soft_goal_delta: +55% — Cmd+K palette Wave-28 #236; progressive disclosure beyond palette remains +soft_goal_delta: +95% — progressive disclosure beyond palette Wave-32 #270 ### L81.13 — Help & Documentation Accessibility score: 3 glyph: ✓ @@ -212,5 +214,6 @@ Wave-28: L81.12 Cmd+K command palette (#236); L81.12 +1; live-daemon native atta Wave-29: L81.14 expand command palette actions (#249); L81.14 +1. Wave-30: L81.9 overlay Escape consistency + a11y (#257); L81.9 +1 (2→3). Wave-31: L81.8 design-token single source (#263); L81.8 +1 (2→3). -CLUSTER_TOTAL score=43/45 pct=96% grade=A +Wave-32: L81.12 progressive disclosure beyond command palette (#270); L81.12 +1 (2→3). +CLUSTER_TOTAL score=44/45 pct=98% grade=A CLUSTER_DONE cluster=C09 repo=SessionLedger diff --git a/audit/SCORECARD.md b/audit/SCORECARD.md index 495e7d17..6b89af2f 100644 --- a/audit/SCORECARD.md +++ b/audit/SCORECARD.md @@ -3,8 +3,8 @@ **Repo:** KooshaPari/SessionLedger **Date:** 2026-07-14 **Repo-type profile:** CLI+daemon + desktop (sl-daemon + sl-viewer) -**Auditor:** cursor-w31-reaudit -**Commit audited:** a7d1a8e (origin/main / Wave-31) +**Auditor:** cursor-w32-reaudit +**Commit audited:** 776910b (origin/main / Wave-32) > Rubric SSOT: phenotype-org-audits/audit-v38 @@ -13,15 +13,15 @@ | Cluster | Category | Pillars | Score (sum/max) | Pct | Grade | Notes | |---------|----------|---------|:---------------:|:---:|:-----:|-------| | C00 | Architecture + Module | L0-L9 | 28/30 | 93% | A | see audit/.lane-c00 | -| C01 | CI, DX, Observability | L10-L19 | 27/30 | 90% | A | see audit/.lane-c01 | +| C01 | CI, DX, Observability | L10-L19 | 28/30 | 93% | A | see audit/.lane-c01 | | C02 | Error handling, API, Governance | L20-L29 | 28/30 | 93% | A | see audit/.lane-c02 | | C03 | Agent Readiness | L30 | 36/36 | 100% | A | see audit/.lane-c03 | | C04 | Security | L31-L40 | 26/30 | 87% | B | see audit/.lane-c04 | | C05 | Observability (deep) | L41-L50 | 29/30 | 97% | A | see audit/.lane-c05 | | C06 | Supply Chain | L51-L60 | 26/30 | 87% | B | see audit/.lane-c06 | | C07 | DX, QEng, Portability | L61-L70 | 29/30 | 97% | A | see audit/.lane-c07 | -| C08 | Eval Coverage | L71-L80 | 27/30 | 90% | A | see audit/.lane-c08 | -| C09 | Accessibility + UX | L81-L95 | 43/45 | 96% | A | see audit/.lane-c09 | +| C08 | Eval Coverage | L71-L80 | 28/30 | 93% | A | see audit/.lane-c08 | +| C09 | Accessibility + UX | L81-L95 | 44/45 | 98% | A | see audit/.lane-c09 | | C10 | Visual Identity | L96-L107 | 36/36 | 100% | A | see audit/.lane-c10 | | C11 | Packaging + Distribution | L108-L122 | 37/45 | 82% | B | see audit/.lane-c11 | @@ -29,25 +29,24 @@ **Weighted overall score:** 93% · **Overall grade:** A -(Raw rubric total across all 12 clusters. Sum 372 / 402.) +(Raw rubric total across all 12 clusters. Sum 375 / 402.) -## Wave-31 Delta +## Wave-32 Delta | Cluster | Before | After | Raw delta | Evidence-backed movement | |---------|:------:|:-----:|:---------:|--------------------------| -| C04 | 25/30 | 26/30 | +1 | OSV/NVD CVE feed SSOT + SelfCheck (#259); L38 2→3 | -| C07 | 28/30 | 29/30 | +1 | Lifecycle FSM property tests (#261); L66 2→3 | -| C08 | 26/30 | 27/30 | +1 | Cross-language fixture parity SSOT + blocking SelfCheck (#260); L75 0→1 | -| C09 | 42/45 | 43/45 | +1 | Design-token single source (#263); L81.8 2→3 | -| **Overall** | **368/402 (92% A)** | **372/402 (93% A)** | **+4** | Conservative; four pillars only | +| C01 | 27/30 | 28/30 | +1 | i18n scaffold / locale catalog stub (#269); L16 0→1 | +| C08 | 27/30 | 28/30 | +1 | Cross-language structural OKF invariant harness (#267); L75 1→2 | +| C09 | 43/45 | 44/45 | +1 | Progressive disclosure beyond command palette (#270); L81.12 2→3 | +| **Overall** | **372/402 (93% A)** | **375/402 (93% A)** | **+3** | Conservative; three pillars only | ## Headline Findings -- **Strongest:** C03/C10 (100% A); C05/C07 (97% A); C09 (96% A); C00/C02 (93% A) +- **Strongest:** C03/C10 (100% A); C09 (98% A); C05/C07 (97% A); C00/C01/C02/C08 (93% A) - **Weakest:** C11 Packaging (82% B); C04/C06 (87% B) -- **Wave-30 → Wave-31:** 92% A (368/402) → 93% A (372/402), +4 raw points -- **Held (no score):** #262 crypto inventory KMS/at-rest Phase-0 deferred guidance (C02 L22 already 2; in-tree KMS unpaid); #264 soft loom concurrency smoke (C00 L7 soft `continue-on-error`; full loom/shuttle/blocking miri unpaid) -- **Remaining unpaid:** maintainer 2FA (C04 L36), full SLSA-L3 isolation (C06), unconditional release-blocking OCI (C06), Authenticode/notarization (C11 L112), live brew/winget publish, live Alertmanager webhooks, continuous profiling push backend, full loom/shuttle/miri, jemalloc/production allocator, cross-language adapters beyond fixture parity (C08 L75), multi-tenant / in-tree PII redaction pipeline (C02 L24), in-tree KMS/envelope encryption (C02 L22) +- **Wave-31 → Wave-32:** 93% A (372/402) → 93% A (375/402), +3 raw points +- **Held (no score):** #266 sustained fuzz cadence soft job (C07 L67 soft `continue-on-error`; longer crash-corpus triage unpaid); #268 seccomp/no-net soft policy (C04 L40 soft CI; hard rootless/no-net unpaid); #271 W3C traceparent worker helper (C05 L44 already pillar max; OTel parent-context/tracestate unpaid) +- **Remaining unpaid:** maintainer 2FA (C04 L36), full SLSA-L3 isolation (C06), unconditional release-blocking OCI (C06), Authenticode/notarization (C11 L112), live brew/winget publish, live Alertmanager webhooks, continuous profiling push backend, full loom/shuttle/miri, jemalloc/production allocator, native language adapters beyond structural fixture parity (C08 L75), multi-tenant / in-tree PII redaction pipeline (C02 L24), in-tree KMS/envelope encryption (C02 L22), Fluent/ICU multi-locale (C01 L16), hard seccomp/no-net CI (C04 L40) ## N/A / soft goals