bdeshi/khosra
0
0
Fork 0
Code Issues Pull Requests Releases Activity

close Arc 1: invariants checked, latent list triaged, retro written

Browse Source 
/invariants at the arc boundary: 1, 3 and 5 held and were checked rather than
assumed; 2, 4, 6, 7, 8 and 9 are not yet applicable, with the pre-freeze core
figure recorded as 619.

Invariant 2 turned up a load-bearing default nobody had written down: goldmark
omits raw HTML unless WithUnsafe is set, verified, and that is the only reason
authored Markdown cannot inject script today. The obvious move when a shortcode
needs to emit HTML removes it, so it is now a latent item triggered by queue
entry 12 rather than a surprise.

The other two latent items are triaged as the arc-close rule requires: the
counter-correctness gap is accepted with a reason, the untrusted-boundary gate is
scheduled to Arc 3.
This commit is contained in:
Claude Opus 5
2026-07-30 02:01:48 +06:00
committed by bdeshi
parent 159e5feb94
commit 01ac1bf431
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/state.md
+10 -3
View File
@@ -48,8 +48,9 @@ with a stated reason. A list nothing drains is a graveyard of known defects.
| Item | Why it waits | Trigger to fix |
|---|---|---|
| No mechanical check that the counters are *correct* | The coupling gate makes forgetting them impossible, which is the real failure mode; checking values needs code to count | 3rd transform or 2nd route |
| No mechanical gate on the untrusted boundary (ADR-0003) | Nothing untrusted exists yet | The comment path, Arc 3 — a test that untrusted input reaches no shortcode or template evaluation |
| No mechanical check that the counters are *correct* | Accepted at the Arc 1 boundary: the coupling gate makes forgetting them impossible, which is the real failure mode, and checking the values needs code to count | 3rd transform (queue 12) |
| No mechanical gate on the untrusted boundary (ADR-0003) | Scheduled to Arc 3: nothing untrusted is read yet | The comment path — a test that untrusted input reaches no shortcode or template evaluation |
| Raw HTML in Markdown is currently omitted only because goldmark's default omits it | Verified at the Arc 1 boundary, and it is what keeps invariant 2 intact for authored content. `html.WithUnsafe()` is the obvious move when a shortcode needs to emit HTML, and it silently turns authored Markdown into an injection path | Shortcodes (queue 12) — if unsafe rendering is enabled, the trusted/untrusted split must be real code, not a default |
## Open questions blocking Arc 1
@@ -66,4 +67,10 @@ record of what actually landed. If that file is absent, read the log and rebuild
One line per completed arc: what it cost, what it taught, what it made unnecessary.
- (empty)
- **Arc 1 — the spine.** 619 core lines, 3 dependencies, 4 queue entries. Taught: `os.Root` makes the
path guard a property of the type, so the latent item that shipped with the harness died instead of
being implemented; and running the gates against real code found six defects *in the gates* — an
allowlist parser that rejected its own documented format, two advisories that fired only on correct
code, a coupling gate that demanded explanations for permission edits, an untidy `go.mod` hiding a
direct dependency, and a nesting check off by one level. Made unnecessary: a hand-rolled traversal
cleaner, and a second routing branch — the resolver arrived by counter at exactly the right moment.