docs: re-anchor ADR 0152's rotted citations by symbol, and correct a Fail verdict PHI.md no longer had - #158
Merged
Merged
Conversation
…ted at each other's code Every line citation in the memory-hygiene paragraph had rotted, and this class of rot is silent by construction: they render as markdown link text over a target carrying no line fragment, so the link always resolves and no link checker can ever see it. :163 claimed _secure_zero -> prose inside cell_aad()'s docstring; _secure_zero is :187 :185-199 claimed mlock residency -> _secure_zero's own body; _lock_memory is :207-225 :314-325 claimed DEK zeroization -> _install_key is :391-411 :462 claimed plaintext wipe -> self._write_v2 = write_v2; the wipes are :713 and :782 The first two had come to point at each other's code. A renumber would not have surfaced that -- only opening both targets does. Re-anchored by SYMBOL rather than by corrected line numbers, since new numbers rot identically at the next refactor. Also in the rung-1 row: "four" posture fields is seven (three _self_reported_*, plus _readout_source, _operator_declared, _readout_contradicts_declaration and _note), and the present-tense "ENGINE_UI_SEAM 12 -> 13" reads as current state when the seam is 16 today -- retained as release history and marked as such. Verified against origin/main 5ad42ac: the cited source files are byte-identical between that tree and this base, so the symbol anchors hold on either. No claim in the ADR changed. Only the pointers were wrong.
…rd is the scorecard Two defects in one paragraph, both live on main. 1. It stated 11.7.1 "still reads **Fail**". The rubric on the same main reads `na` under rule 1 -- so PHI.md publicly contradicted ASVS-ASSESSMENT-METHOD.md. 2. It named a dated prose file as "the ASVS L3 assessment of record". ADR 0156 retired that lineage: the record is docs/security/asvs-scorecard.toml, rendered and CI-gated. Citing a dated assessment as the verdict of record is the exact failure 0156 exists to stop -- prose asserts facts about code, and the code moves. The replacement states the verdict, names the real record, and says why the cell is out of scope (the verb is a property of the hosting substrate, which ASSESSMENT-METHOD §2 places outside the assessed software). It also keeps the operational point explicit, per §2.1: an out-of-scope verdict buys nothing -- the CPython-heap residual is unchanged either way and a deployment still needs the host-side control. The old wording is described rather than silently dropped, so the correction is legible.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two docs-only corrections. Both are live inaccuracies on
main, and neither depends on any verdict decision still in flight.1. ADR 0152''s code citations pointed at each other (
15f64510)Authored by the ASVS summary session; I am driving it. Not merely stale line numbers — two citations were wrong about each other:
:43citedstore/crypto.py:163for_secure_zerowhile:44cited:185-199for mlock residency, and the two had swapped. A line-number check would call both "close enough"; only a content check finds it.Re-anchored by symbol —
_secure_zero(),_lock_memory()/_unlock_memory(),_install_key()— so they resolve by grep and stop rotting when the file moves. Same principle ADR 0158 prescribes.2.
PHI.mdreported aFailthe record no longer carried (653fb069)The paragraph stated:
Two defects in one sentence, both live:
docs/ASVS-ASSESSMENT-METHOD.md:65on the samemainreads`na`under rule 1. PHI.md publicly contradicted the rubric.docs/security/asvs-scorecard.toml, rendered and CI-gated. Citing a dated assessment as the verdict of record is precisely the failure 0156 exists to stop: prose asserts facts about code, and the code moves.The replacement states the verdict, names the real record, and explains the scope reasoning (the verb is a property of the hosting substrate, which §2 places outside the assessed software). Per §2.1 it keeps the operational point explicit: an out-of-scope verdict buys nothing — the CPython-heap residual is unchanged and a deployment still needs the host-side control. The old wording is described rather than silently dropped, so the correction is legible to a reader who saw the previous version.
Verification
still reads **Fail**→ 0;assessment of record→ 0;ASVS-L3-ASSESSMENT-2026-07-22→ 0; scorecard named as record → 1.mainbefore the PHI commit: 1 file, 13 insertions, 6 deletions — the citation fix alone, nothing reverted.origin/maincleanly; no conflicts.--no-verify.Docs only. No code, no verdict changes to the register — that stays with the vault and its owner decision.
🤖 Generated with Claude Code