Repository navigation
docs(readme): claim 26 module points with a demo and a risk per module - #197
Merged
Merged
Conversation
Keep LESdylan's 10 modules (16 points) and add the module-of-choice app factory (2) and SSRF guard (1), Organisation system (2), Advanced permissions (2), RAG (2) and Content moderation (1). Each row says how to demo it, on which stack and with what switched on, and rates the risk of a live failure, because a module that fails live scores zero and bonus points stop at 19. Public API and Health/status + backups are listed as stretch, not counted. 2FA and GDPR stay out, in Known limitations.
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
Conflict in README.md, Modules section only: develop's 4eedf90 (danielfdez17) added a separate modules-of-choice table. Kept this branch's single table and folded in develop's additions, re-checked at groot main's pins: the cargo test SSRF demo (run from src/data-plane-router, the cargo workspace), http/mod.rs:90 and its 30 tests, the live-proof branch for m176/m177 (#177), the risk of the SSRF minor being counted as part of the data plane, and wiki/DEFENSE.md. Dropped "provisioned this way in production" (unproven) and the commit counts (the Features table already carries them). Who is stated per module of choice.
W12 Design system: @osionos/ui (36 components, 94 tokens, 5 test files in osionos-ui CI, green at the pin). Medium, not low: its tests run only in osionos-ui's CI, the icons are Lucide, and no token sets a font family. W13 Advanced search: search, filter, sort and paging in the database views, with canvas, bridge and Playwright tests in osionos CI, green at the pin. Low. Totals: low 13, medium 11, high 2; +5 above 19 if every high-risk module fails, -6 if every medium- and high-risk module fails.
Contributor
Author
|
@danielfdez17 Merging develop into this PR conflicted with your 4eedf90 (#196) in the README's Modules section. I kept this PR's single module table and folded your additions into it rather than keeping a second table. Please check the result before this merges (commit 067e3c6):
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The subject asks for 14 points, and bonus points stop at 19. A module that fails live scores zero, so the README should claim more than 19, and only what we can defend. Each claim also needs the demo and its risk written down. This PR follows #187 (merged), which took LESdylan's 10 modules (16 points).
What was added, and why each one holds up
LESdylan's 10 modules stay as they are. Added (codes W6/U4/U5/I2/I5/D4 follow the subject's order within each category, the same way LESdylan's codes do. The subject is not in this repo; please check the codes against the team's copy):
main's pinsselfserve_apps.go:55-58, m176/m177 (static in CI)APPS_SELFSERVE_ENABLEDclassify.rs:90-155,adapter.rs:57-61(pins the checked IP);rust-data-plane+ Engine conformance (http)bridge-workspace-*routes, mounted with no flag check (bridge-account-mounts.mjs:72); 7 bridge testsbridge-roles.mjs:28-29, page access, share rules; mounted with no flag check (:75)retrieval/search.ts,rerank.ts, HNSW migration; AI-service CIbridge-moderation-gate.mjs:70,moderation/l1.ts:99; 4 + 5 testsModule-of-choice points total 3, the cap. Public API (W6, 2) and Health/status + backups (D4, 1) are listed as stretch, not counted. 2FA and GDPR are not claimed (runtime bugs, kept in Known limitations).
The Modules table now has: code, module, type, points, how we demo it (stack + what to switch on), main files, tests → CI job, risk. The old Evidence table is merged into it. The "Three modules need the deployed stack" warning in Instructions is updated to match.
Risks — read this first
The margin depends on the medium-risk modules: they need their switches raised and rehearsed before the defense. One switch,
--profile ai, carries I3 + I2 + I5 (5 points), which fail together. W12 and W13 (LESdylan's) are rated high because neither the README nor this PR cites evidence for them.Overlaps checked, nothing dropped: W1 replaces W2/W3 (not claimed); D3 vs the factory (same control plane, different requirement and evidence); U5 vs U4 (different files); W5 and U1 both cite
bridge-account-profile.mjs(kept as claimed).Evidence
main's pins (grobase21c132b6, osionos735c40fd, opposite-osiris34237735):git cat-file -e <pin>:<path>for each one, all OK. Line refs re-read; m102 moved to grobaseci.yml:934.rows=16 total=26 risk={low:12, medium:10, high:4} choice=3 dup_codes=0, exit 0.