DRAFT triage: builder-2's dead lane -- six commits that never landed, behind 33 of squash residue - #530

Draft

wshallwshall wants to merge 53 commits into

mainfrom

claude/builder-2-6e58d6

Commits on Aug 22, 2026

fix(containment): validate the codeset rename SOURCE and fold the Corepoint module stem (BACKLOG #1130)
wshallwshall
committed
e5505a9
docs(codesets): record what the rename-source guard changed, and drop a false mirror claim (BACKLOG #1130)
wshallwshall
committed
32fb311
fix(apiclient): percent-encode every interpolated path segment and allow-list the URL scheme (BACKLOG #1107)
wshallwshall
committed
c28ad75
test(codesets): pin every refusal branch on the rename source, not just the separator (BACKLOG #1130)
wshallwshall
committed
d31ea1b
test(corepoint): census escapes the out root cannot contain, and record the real red (BACKLOG #1130)
wshallwshall
committed
9d59ff4
fix(transports): refuse ech_egress where the SNI cannot be hidden, and route the token hop through the sidecar (BACKLOG #1176)
wshallwshall
committed
c52927b
feat(uploads): make the upload quota cross-process via a store reservation (BACKLOG #1112)
wshallwshall
committed
142b926
docs(uploads): the leaked-reservation self-heal claim was false, and it was mine (BACKLOG #1112)
wshallwshall
committed
b3d1eb4
fix(redact): the log redactor emitted the token it claimed to redact (BACKLOG #1183)
wshallwshall
committed
77d03ca
Merge remote-tracking branch 'origin/main' into claude/builder-2-6e58d6
wshallwshall
committed
7898303
Merge remote-tracking branch 'origin/main' into claude/builder-2-6e58d6
wshallwshall
committed
cb2e79d
feat(api): take the PHI search needle off the query string (BACKLOG #1184, ASVS 14.2.1)
wshallwshall
committed
091a9b7
docs(crypto-gate): the ide/ exclusion is a fact about the LANGUAGE, not a finding that ide/ is crypto-free (BACKLOG #1164)
wshallwshall
committed
0e44e23
fix(remotefile): the SFTP connector proposed an HMAC over a disallowed hash (BACKLOG #1171, ASVS 11.4.1)
wshallwshall
committed
f385a6d
docs(readme): the supply-chain note claimed signing coverage two of three releases do not have (BACKLOG #1193, ASVS 15.2.4)
wshallwshall
committed
4f46ece
test(bash): resolve a bash that can SEE this process's files, in all four modules (BACKLOG #1216)
wshallwshall
committed
70186e4
test(bash): my own positive control was an identity and certified a broken probe (BACKLOG #1216)
wshallwshall
committed
e464906
fix(http-auth): refuse an HTTP Digest challenge that names a disallowed hash (BACKLOG #1171, ASVS 11.4.1)
wshallwshall
committed
5f7be3e
feat(smtp-auth): an approved AUTH mechanism, and only over an encrypted channel (BACKLOG #1171, ASVS 11.4.1)
wshallwshall
committed
87d7223
fix(xml-dsig): pass an accept-set instead of letting signxml's default choose (BACKLOG #1171, ASVS 11.4.1)
wshallwshall
committed
d2c1fd9
Merge remote-tracking branch 'origin/main' into claude/builder-2-6e58d6
wshallwshall
committed
e16b3e5
Merge remote-tracking branch 'origin/main' into claude/builder-2-6e58d6
wshallwshall
committed
76b000c
fix(alerts): the alerts SMTP hop sent AUTH credentials in cleartext (BACKLOG #1171, ASVS 11.4.1)
wshallwshall
committed
925bc6b
fix(smtp): a shipped control that had never run on the path it guards (BACKLOG #1171, ASVS 11.4.1)
wshallwshall
committed
cf8dfed
fix(smtp): a policy refusal was reaching the worker as "our bug" (BACKLOG #1171, ASVS 11.4.1)
wshallwshall
committed
ca16181
Merge remote-tracking branch 'origin/main' into claude/builder-2-6e58d6
wshallwshall
committed
f6796e8
test(tooling): classify test_bash_resolver.py, which the partition guard caught (BACKLOG #1216)
wshallwshall
committed
e7ae619
Merge remote-tracking branch 'origin/main' into claude/builder-2-6e58d6
wshallwshall
committed
7c20ddb
fix(tests): the resolver picked the bash that rewrites PATH (BACKLOG #1216)
wshallwshall
committed
4b78395
test(dependabot): self-certify that a prepended stub actually WON (BACKLOG #1216)
wshallwshall
committed
110c125
Merge remote-tracking branch 'origin/main' into claude/builder-2-6e58d6
wshallwshall
committed
90ffcb3
fix(tests): the wrapper predicate matched an ordinary Linux bash (BACKLOG #1216)
wshallwshall
committed
fce7d0a
webconsole: fetch-metadata isolation for /ui, including the Mount (#1122)
wshallwshall
committed
4eee9f8
Merge remote-tracking branch 'origin/main' into claude/builder-2-6e58d6
wshallwshall
committed
8b5e833
webconsole: connection names cannot escape a /ui path segment (#1107)
wshallwshall
committed
9e4c152
webconsole: encode the one role id that skips its own 404 lookup (#1107)
wshallwshall
committed
549e304
init writes a loadable config, and check can fail on one (#1318, #1320)
wshallwshall
committed
721635c
docs: the instruments that returned confident wrong answers, tracked
wshallwshall
committed
cb010d7
docs: sharpen the marker rule to its actionable form
wshallwshall
committed
67843d6

Commits on Aug 24, 2026

Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
482ed77
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
f406877
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
2c2db57
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
4974ed6
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
c3c3a71
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
474845e
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
0a3f04b
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
6d1e4e7
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
7c50235
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
f71a9b0
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
3cfd51c
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
d3b483e
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
49f91c5
Merge branch 'main' into claude/builder-2-6e58d6
wshallwshall
authored
795407b