asvs: approval compensation, upload quota atomicity, TOTP SHA-256 cutover, MLLP inbound pacing - #325

Merged

wshallwshall merged 11 commits into

mainfrom

claude/asvs-handoff-session-b-fec292

Aug 11, 2026

Commits on Aug 11, 2026

fix(approvals): compensate a released-but-unexecuted operation (ASVS 2.3.3)
wshallwshall
committed
146611c
fix(uploads): the shard budget-multiplication claim is false -- correct it and pin it
wshallwshall
committed
85fe7e8
fix(uploads): make the per-uploader quota check-and-write one critical section (ASVS 2.3.4)
wshallwshall
committed
61fe28a
docs(security): the ECH risk acceptance rested on a premise this repo refutes
wshallwshall
committed
c9e110f
chore(ech): retire tools/ech-sidecar, and reconcile the four records that named it
wshallwshall
committed
d5a6cc4
feat(asvs): a structured blocker record for externally-blocked fails (G19 part b)
wshallwshall
committed
936c9ad
feat(auth)!: retire SHA-1 from TOTP in favour of SHA-256 (G18)
wshallwshall
committed
0ace6bb
feat(mllp): pace inbound message rate per connection, default off (ASVS 2.4.1 / 15.2.2)
wshallwshall
committed
e0e979d
Merge remote-tracking branch 'origin/main' into claude/asvs-handoff-session-b-fec292
wshallwshall
committed
ae574b2
docs(security): the ingest-plane row said no rate limit exists -- my own build falsified it
wshallwshall
committed
b3b278e
Merge branch 'main' into claude/asvs-handoff-session-b-fec292
wshallwshall
authored
eebe26c