feat(security): close ASVS 4.2.5 and 9.2.2, and the guards that could not see them - #39

Merged

wshallwshall merged 7 commits into

mainfrom

claude/asvs-partials-pass-scores-2de207

Jul 29, 2026

Commits on Jul 29, 2026

test(security): the threat-model guard could not see a bound described as absent
wshallwshall
committed
54e0272
feat(auth): assert the id_token's declared class, not just its signature (ASVS 9.2.2)
wshallwshall
committed
1ce3a1a
feat(transports): bound what actually ships, not what was configured (ASVS 4.2.5)
wshallwshall
committed
17d8c82
feat(transports): close the last five ASVS 4.2.5 surfaces, and name the sixth
wshallwshall
committed
8a61e4a
fix(secrets): the one credential the docs say to rotate was never fingerprinted
wshallwshall
committed
fdb3f19
Merge origin/main (ADR 0153) into the ASVS 4.2.5 / 9.2.2 branch
wshallwshall
committed
699e182
fix(packaging): our own docs pointed users at an unclaimed PyPI name (ASVS 15.2.4)
wshallwshall
committed
aa861ee