docs(releases): multisession plan for the 41 schedulable backlog items - #165
Merged
Conversation
37 sessions across 5 waves, 60.0 build-days, grouped so no two sessions in a wave
co-own a file. Scope is the non-DEMAND-GATE items from the 2026-08-03 re-score; the
52 demand-gated ones are excluded BY THE RULE and say so, with a pointer -- silently
dropping half the backlog is how a plan gets mistaken for a census.
Sized by coupling, not by item: items sharing a file are one session or different
waves. Every path was verified against HEAD with Glob/Grep/Read.
TWO ADVERSARIAL ROUNDS, and both earned their cost. Round 1 found six defects, two
severe; round 2 re-attacked the fixes and found seven more. All thirteen are applied
and recorded in the plan's own "Adversarial review" section rather than quietly fixed.
The two severe ones:
1. The plan de-conflicted per-item BANNERS but never mapped the live ranked table --
93 contiguous rows at docs/BACKLOG.md:180-272, plus a 4-line census at :169-171
that every session would decrement. Measured: #233@191/#326@192 and
#334@208/#347@209 are ADJACENT lines in different Wave-1 sessions. Two sessions
each re-deriving the census from a tree the other already decremented merge CLEAN
and publish a wrong count -- the exact silent corruption this plan exists to stop.
Both surfaces are now owner-only; sessions move banners, the owner reconciles once
per wave. The file already licenses this at :165: "the banner is the live record.
This table is a view of it, and where the two disagree the banner wins."
2. #334's widened semgrep would need nosemgrep annotations in
scripts/security/scan_forbidden.py -- which Wave 1's leak-gate session is
rewriting. The plan called those files "unowned"; they are not.
Round 2's HIGH finding is the instructive one: taking scan_forbidden.py away from #334
moved the annotation into a sibling W1 session, creating an UNDECLARED same-wave merge
order. A de-confliction that silently creates a dependency is only half a fix. W1 is
therefore not order-free -- leakgate merges before semgrep -- and #334 gets an explicit
escape hatch (a .semgrep paths: exclude, recorded in the PR body) because every other
owner of a newly-scanned file sits in a LATER wave, making "hand it to the owner"
temporally unsatisfiable for a W1 blocking gate.
Worth recording plainly: three of the four line-number defects across both rounds were
introduced by a VERIFICATION pass, including a false "correction" of #341's citation
from dryrun.py:112 to :110 -- presented as verified, on the highest-value item in the
backlog, and pointing at a line holding no logic (:112 is the narrowing; :110 is
`if result is None:`; :109 closes the docstring). Re-measuring is not optional because
a number came from a careful reader; it is required because it did.
The forbidden-content gate then blocked the first commit attempt of this file: a
phantom-file row for #228 reproduced a ported-feed config path carrying a site
identifier and named the maintainer-internal migration repo. Rewritten to say what the
row needs to say without reproducing either. The token was removed, not allowlisted.
Coverage appendix: 41 items, 11/11/6/6/7 by wave, none dropped or double-placed.
Wave efforts 11.0 / 17.0 / 12.0 / 7.5 / 12.5 = 60.0.
wshallwshall
enabled auto-merge (squash)
August 4, 2026 02:00
wshallwshall
added a commit
that referenced
this pull request
Aug 4, 2026
…two docs named a function that does not exist (#176) ASVS 12.1.5 (Encrypted Client Hello) is a `fail` that CANNOT be built — ECH needs OpenSSL 4.0 and the pinned runtime is 3.5.7. It is accepted as a Fail under register block 12. So the only live harm on this cell is its documentation, and all of it was wrong. 1. THE OPERATOR RECIPE COULD NOT LOAD, two independent ways, both verified by execution: * the loader accepts only `[[inbound]]` / `[[outbound]]` arrays, so the documented `[connections.<NAME>.settings]` table fails with "unknown top-level key(s) connections"; * and even with the right shape no factory accepts the keys — `Rest() got an unexpected keyword argument 'ech_egress'`. The factory IS the schema. Anyone following the shipped recipe got an error, not ECH. 2. `ech_route_from_settings` DOES NOT EXIST anywhere in the tree. Named by ADR 0139 and, independently, by the master test plan's SEC-71 row. The real function is `ech_sidecar_url_from_settings` (`rest.py:1077`). The test-plan row also cited `rest.py:1084` twice — that is inside the docstring, not the def. 3. `tools/ech-sidecar/README.md` prescribed pairing the sidecar with the ADR 0126 forward proxy. The engine REFUSES that pairing at construction: "ech_egress and proxy_url are mutually exclusive — the ECH sidecar IS this connection's egress path". The section also claimed engine wiring "is a follow-up", which Increment 1 made stale. ⭐ THE DRAFT'S CENTRAL CLAIM WAS FALSE AND I EXECUTED BOTH ALTERNATIVES BEFORE WRITING THEM. It said "the ONLY authoring surface is a raw ConnectionSpec settings mapping". ADR 0139 is reachable code-first TWO ways, both run against the shipped factories in this worktree: (a) `Rest(url=...)` then assign into `.settings`, and (b) a hand-built `ConnectionSpec`. Only `connections.toml` genuinely cannot express it. Publishing "there is no way to do this" next to a fix for a recipe that did not work would have been the same defect twice.⚠️ And I corrected the correction. The reviewing pass framed form (a) as "the shipped factory plus a settings assignment — no ConnectionSpec at all". Also false: `Rest()` RETURNS a `ConnectionSpec` (measured — `type(Rest(url=...)).__name__` is `ConnectionSpec`). The true distinction is whether you must IMPORT one, and the doc now says exactly that. Both documented FAILURE modes were re-executed too, so the error strings quoted are real. ⛔ COUPLED — the vault half must land with this. This commit replaces the block ASVS cell 12.1.5 anchored on (`samples/ech-sidecar/README.md:61`); the paired re-anchor to `:80` is committed in the vault. Proven necessary, not assumed: the PUBLISHED scorecard against this tree gives EXIT=1 with `FAIL 12.1.5: samples/ech-sidecar/README.md:61 no longer contains ...`, and EXIT=0 with the paired repair. Same template as the 13.2.2 pair in 1e9cc4c.⚠️ Rebased before committing, and this is why: my branch still carried the PRE-SQUASH commit 01b11b8, whose content merged as 1e9cc4c. Diffed against main from there, this change showed -43/-26/-53 on three files I never touched — it would have REVERTED merged work from #165 and #167 behind a diff that looks clean. Moved onto a fresh branch from current main; the diff is now exactly the four ECH files. 399 doc-gate tests pass (the master test plan is prose-gated and bit two commits recently, so the edit there is a minimal rename plus two line-number corrections). No verdict moves: 12.1.5 stays `fail`, correctly — none of this makes ECH reachable.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One commit, one file, 316 insertions:
docs/releases/SCHEDULABLE-BACKLOG-MULTISESSION-PLAN.md.git diff origin/main...HEADshows exactly that and nothing else.Why this branch and not the original
This content was originally pushed onto
claude/backlog-open-non-gated-35712a, which had already been merged as #163 and deleted. The follow-up push recreated that branch, so it came back carrying all six already-merged commits plus this one — and a three-dot diff againstmainreported 6,937 insertions across 11 files, because the merge base predates the squash. That reads as "re-applies everything" and a PR from it could have reverted whatever landed onmainin the meantime.Nothing was ever wrong with
main; it was a stale ref. The author cut this clean branch fromorigin/maininstead, and the stale remote ref has been deleted.Verified before deleting it, rather than assumed: of the 11 files those commits touched, 10 show zero difference from
main(they landed via #163's squash), and the one remaining file is byte-identical on this branch (blobebd99f778aon both). The pre-squash history is still held by local refs, so nothing is lost.Risk
Docs-only. No gate reads this file and nothing depends on it.