Repository navigation
docs(remediation): P2 rows in the banner, one per ticket - #414
Merged
Merged
Conversation
The banner lumped P2-2..P2-8 under one pending row, and four of them have since shipped. Each ticket now has its own row with the PR that closed it. P2-1 says plainly that RLS is in the schema but inert until the application switches into the scoped role. The P2-6 date is corrected from 2026-09-20 to 2026-09-24, the day #384 was committed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CG4J2cv5q6iAZYZG4KfBdz
The note paragraph had been inserted between rows, which ended the table and left the §4.1 sweep row rendering as stray pipe text. It now follows the table. P2-1, P2-3 and P2-5 name the PRs that carry their open work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
P2-7 is incorrectly marked not started despite completed doc-test work recorded in the roadmap.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Updates the remediation banner to show each P2 ticket’s current status separately.
Changes:
- Replaces the grouped P2 row with per-ticket entries.
- Restores correct Markdown table rendering and adds a verification date.
| File | Description |
|---|---|
docs/REMEDIATION_PLAN.md |
Expands and updates P2 remediation statuses. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
| > | P2-4 | driver 6 | ✅ | No production `assert` (#388); every blind `except` argued or narrowed under `BLE001` (#389), 2026-09-25 | | ||
| > | P2-5 | driver 6 | ⏳ | Open in #408, not merged | | ||
| > | P2-6 | driver 6 | ✅ | PyJWT, 2026-09-24 (#384); SECURITY §2 retired | | ||
| > | P2-7 | driver 4 | ◐ | Doc tests in part: `test_configuration_doc_covers_config`, `test_env_example_is_read` and `test_permissions_doc_matches_routes` hold. Still open: the `src/...` path and `/api/...` endpoint tests, and the split of the journal under `docs/history/` | |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
| | 14 | CONN-2 (connector UI in the document section) ⏸️ **parked 2026-08-26** — see the ticket for what stays true while it is | — | | ||
| | 15 | P2-6 (PyJWT) ✅ 2026-09-20 + P2-4a (asserts) ✅ + P2-4b (`BLE001`) ✅ 2026-09-21 — **sprint complete**. P2-6 retired two open Dependabot alerts. P2-4b was the one item that was not mechanical: 120 handlers read individually, 4 narrowed, 11 that were failing silently given a log | 3–4 days | | ||
| | 16 | P2-2a (security smoke against the shipped compose) ✅ 2026-09-25 + P2-2b (object-authorization matrix over the wire) + P2-1b (row-level security) | 1 week | | ||
| | 16 | P2-2a (security smoke against the shipped compose) ✅ 2026-09-25 + P2-2b (object-authorization matrix over the wire) ✅ (#399) + P2-1b (row-level security) ✅ 2026-10-02 (#400, #404, #406, #407) — **sprint complete** | 1 week | |
| > | D7 | README claim | ✅ | "Hardened beta", 2026-09-16 | | ||
| > | P2-1 | driver 1 | ◐ | The `Scope` value object and the static CI check shipped with P0-1. Row-level security has not | | ||
| > | P2-2..P2-8 | drivers 2–6 | ⏳ | [ROADMAP Initiative 10](ROADMAP.md#initiative-10--security-audit-follow-through-p2), Sprints 15–18 (2026-09-17). P2-6 shipped 2026-09-20 (PyJWT; SECURITY §2 retired). P2-8 is closed by decision: S3 removed, MCP kept behind a token | | ||
| > | P2-1 | driver 1 | ✅ | The `Scope` value object and the static CI check shipped with P0-1. Row-level security: policies and the `localchat_scoped` role (#400, migration 0017), the `get_connection(scope=)` seam and [ADR-5](ADR.md) (#404), every read path taking a `Scope` (#406), and enforcement — a workspace-scoped transaction runs as the restricted role (#407), 2026-10-02. By design the `ALL_WORKSPACES` paths (admin, webhook receiver, `SyncWorker`) stay on the owner role. Residual: a *statement*-level pooler would break the transaction-local scope; to confirm against the deployed database | |
…er-p2 # Conflicts: # docs/REMEDIATION_PLAN.md # docs/ROADMAP.md
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…er-p2 # Conflicts: # docs/ROADMAP.md
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The REMEDIATION_PLAN banner grouped P2-2..P2-8 into one pending row, but four of those tickets have shipped since then. Each ticket now gets its own row:
localchat_scoped. Enforcement is open in feat(db): ADR-5 and the get_connection(scope=) seam for row-level security (P2-1b-i) #404, refactor(db): every read path takes a Scope — "every workspace" is passed, never defaulted (P2-1b-ii) #406 and feat(db): enforce row-level security on workspace-scoped transactions (P2-1b-iii) #407The second commit fixes a rendering bug from the first. The note paragraph had been placed inside the table and cut off the
§4.1 sweeprow.Docs only.
pytest tests/unit -k doc: 287 passed.🤖 Generated with Claude Code