Fix the CI dependency install, triage the Redis finding, close two benchmark loose ends - #63

Merged

laugiov merged 17 commits into

mainfrom

claude/ci-integrity-security-triage-ynda74

Aug 17, 2026

Commits on Aug 17, 2026

Fix the dependency install that PR #62 was merged past, and name the rule
claude
committed
b66c770
Register SEC-002: Redis runs unauthenticated on a network assumed trusted
claude
committed
23ed55a
Make the benchmark taxonomy append-only and score severity against severity
claude
committed
0cb75c7
Seed the redirected Composer cache from the image, and record where the cost is
claude
committed
31d195d
Cut the request burst: the remaining 429s come from codeload, which no token lifts
claude
committed
631a863
Build the backend image once per run instead of four times concurrently
claude
committed
5f866d5
Cache the build layer, and correct the causal story: codeload is throttling us
claude
committed
2ab8c98
Fall back to git clone when codeload will not serve dist archives
claude
committed
8ba76f0
Stop the factory gate from failing on a single transient checks-API error
claude
committed
6347d6e
Let the source fallback survive the dev-dependency prune
claude
committed
bc574da
Correct the cost claim for building once: it is two minutes, not free
claude
committed
284b1ad
Record the measured build numbers, and what is still unproven
claude
committed
d28a72a
Cancel superseded factory-gates runs, like ci.yml already does
claude
committed
caa3fe4
Stop handing the demo image a token its pinned Composer cannot parse
claude
committed
f8de5d3
Fix six findings from reviewing this PR against itself
claude
committed
3e5ecc6
Close the chore-scope hole this PR walked through, and three smaller review items
claude
committed
07f898a
Remove body.txt, a test fixture git add -A swept into the last commit
claude
committed
8677bc5

Navigation Menu

Fix the CI dependency install, triage the Redis finding, close two benchmark loose ends - #63

Fix the CI dependency install, triage the Redis finding, close two benchmark loose ends#63
laugiov merged 17 commits into
mainfrom
claude/ci-integrity-security-triage-ynda74

Commits on Aug 17, 2026

Fix the dependency install that PR #62 was merged past, and name the rule

Register SEC-002: Redis runs unauthenticated on a network assumed trusted

Make the benchmark taxonomy append-only and score severity against severity

Seed the redirected Composer cache from the image, and record where the cost is

Cut the request burst: the remaining 429s come from codeload, which no token lifts

Build the backend image once per run instead of four times concurrently

Cache the build layer, and correct the causal story: codeload is throttling us

Fall back to git clone when codeload will not serve dist archives

Stop the factory gate from failing on a single transient checks-API error

Let the source fallback survive the dev-dependency prune

Correct the cost claim for building once: it is two minutes, not free

Record the measured build numbers, and what is still unproven

Cancel superseded factory-gates runs, like ci.yml already does

Stop handing the demo image a token its pinned Composer cannot parse

Fix six findings from reviewing this PR against itself

Close the chore-scope hole this PR walked through, and three smaller review items

Remove body.txt, a test fixture git add -A swept into the last commit