docs(sds): independent review is no longer a deployment gate (v2.2) - #89
Merged
wshallwshall merged 2 commits intoJul 31, 2026
Merged
Conversation
Owner decision, 2026-07-30. The Secure Development Standards stated that an
independent ASVS-L3 review and DAST were "required before any off-loopback/
production exposure". MessageFoundry is self-hosted, so that call — and the
assessment behind it — belong to the implementing organization. The standard
now records what has and has not been independently verified instead of
gating deployment on it. The engagement remains planned, at an estimated
$25,000-$50,000, intended to be grant- or sponsor-funded.
This brings the engine copy back in line with the website's copy of the same
document (messagefoundry.org/docs/secure-development-standards.md), which was
updated first; the deviation bullet is now byte-identical in both. Without
this the two published versions of the same standard disagree.
Also drops a citation to `security/RELEASE-GATE.md` in that bullet — no such
path exists in this repository, so the reference did not resolve for readers.
Bumped to v2.2 with a version-history entry. No change to the SSDF / ASVS /
HIPAA mappings or Appendix A.
Note for a maintainer: the signed risk-acceptance register that governs this
residual is scoped by the same loopback restriction ("void on any off-loopback
or production exposure"). With the restriction gone from the standard, that
register likely wants re-scoping so the two agree. It lives in the
maintainer-internal docs/security/ set, which is not present in this
checkout, so it is untouched here and flagged rather than fixed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
wshallwshall
enabled auto-merge (squash)
July 31, 2026 01:15
wshallwshall
added a commit
to wshallwshall/messagefoundry-website
that referenced
this pull request
Jul 31, 2026
…red capacity (#96) Owner-directed. Twelve commits, ~46 files. MATURITY. New canonical /status.html - started May 2026, Early Access and beta-level, sole maintainer, AI-assisted development disclosed, no freemium, no support organization, self-assessed but not externally audited - linked from all 32 pages and the sitemap, plus a site-wide de-hyping sweep and a standing CLAUDE.md rule so the posture is not silently reverted. A site-wide Early Access notice bar and 'get involved before 1.0' copy follow, because 19 of 32 pages previously carried no maturity signal at all. STANDARDS. Independent ASVS-L3 review and DAST are no longer stated as a gate on off-loopback/production exposure; that decision belongs to the implementing organization. Doc bumped to v2.2 and both affected PDFs re-rendered. The engine's authoritative copy is updated in MEFORORG/MessageFoundry#89 so the two do not diverge. CAPACITY. Publishes 40 million message events/day at a stated >20% reserve against a measured ~603 events/s ceiling, in total events (in and out), replacing a superseded ~8.4M/day figure whose own source forbade citing it as a product ceiling. Ships a Throughput & Capacity PDF as the citable basis, and discloses the limits alongside the number - loaded store, point estimate rather than soak, and a multi-shard topology not yet blessed for production. ACCURACY. Removes figures the engine's own ADR 0074 condemned (~450 msg/s intake, '~65x faster' NVMe, ~16ms mislabelled as engine-only overhead), corrects the store commit ceiling, re-sources the 2.7x burst factor and ~11.5 KB message size as de-identified live-hospital-feed data, and removes the 'aggregate is the sum of the interfaces' rule from six places including four halves of FAQ/JSON-LD pairs - measured concurrent runs land well below the naive total. QUALITY. Fixes regressions found by verification rather than assumed absent: an invisible 2.00:1 link in a dark hero, focus rings failing 3:1 on light surfaces inside dark scopes, 515px and 366px of trapped whitespace, feature-set hedging that CLAUDE.md forbids, and h1-to-h3 heading skips on five pages. A pre-merge sweep caught a blocker - 'certified' used eight times, a word CLAUDE.md bans by name and that security.html explicitly promises never to use. Verified throughout by measurement in a browser rather than by eye: alpha backgrounds composited, CSS cache busted, 0 contrast failures, 0 horizontal overflow at 1280px and 375px, one h1 per page, 47 JSON-LD blocks parsing and all 73 FAQ pairs byte-identical to their visible answers.
wshallwshall
added a commit
that referenced
this pull request
Aug 7, 2026
… file #1098-#1100 (BACKLOG #1095) (#283) * docs: convert 21 dead BACKLOG line anchors to item references A `BACKLOG.md:<line>` anchor cannot survive an actively edited ledger. The file moved 6,318 -> 6,616 lines during this work alone, and of 43 anchors repo-wide, every one examined had drifted onto unrelated text. Five that were past EOF a day earlier are now IN range and land on plausible-looking wrong items, which is worse than dangling. Item numbers survive both editing and archival, so that is what these become. Root cause, and it is not gradual drift: commit 4ea1501 (the master test plan) is NOT a descendant of 03f1fbd (the 185-item archival). They were parallel branches. The plan's anchors were authored against an 8,742-line ledger and landed beside a commit that cut it to 3,858, so they were stale on arrival, not over time. Recovery was per-site reading with the citing prose as the primary evidence -- it usually names the item inline -- backed by resolving each anchor against the pre-archival ledger at 03f1fbd^. Every mapping was then put to an adversarial reviewer instructed to refute by default. 32 of 43 survived; the 11 refusals were not noise and are deliberately NOT converted here: - Eight sites where the citing CLAIM is dead, not just the pointer. The alerting chapter still asserts #139 and PHI.md "currently contradict each other" when #139 was corrected 2026-08-01 and the code fixed by #323 on 2026-08-02; the ranked-backlog row for #338 is a pre-shipping snapshot. Repointing those would relaunder a false present-tense claim as a fresh, durable-looking reference. They need a content fix, which is a different change. - Six anchors that cannot be attributed to any item, including one pointing at an un-numbered narrative bullet. Left uniform rather than half-repaired: uniform staleness is at least detectable, and a confident wrong pointer is not. - Three that are not citations at all -- two inside a fenced transcript in #1083 reproducing scanner output, and #347's own Source paragraph narrating the falsification test that made the status checker fail on purpose. One mapping was recovered after the review: 16-security-phi:891's "no dormancy contingency" quotes #89's title ("hl7apy security hardening -- dormant-upstream contingency") almost verbatim. One proposal was refuted only on fragment uniqueness, not on the item; applying line-scoped rather than globally makes it safe, which is how all of these were applied. * docs(testing): move the line number out of 23 source-link targets The repo's file_path:line_number citation convention had leaked inside the href: [`pipeline/alerts.py:27`](messagefoundry/pipeline/alerts.py:27). No prefix makes that resolve. Owner's ruling was to move the line out of the target and keep it in the link text, where it already sits -- no second convention, and nothing lost. These carry a second defect that hid behind the first. The targets were also root-relative, the class #280 repaired across 333 hrefs in this same subtree; they were skipped there because link_check.py deliberately skips ":<line>" targets, so each defect concealed the other. Both are fixed here: the line comes out and the ../../../ prefix goes in, matching the form #280 established in these files. All 23 targets were confirmed to exist before rewriting. Repo-wide there are now zero file:line hrefs, so --include-line-cites reports nothing new -- the checker's skip is now a safety net rather than a suppression. * backlog: correct #1095's own counts, and file #1098, #1099, #1100 #1095 recorded four measured counts and three of them were wrong -- in the way the item itself is about. Its href figure of 13 was low by two orders of magnitude against at least 629 repaired sites. Its two anchor counts moved between filing and repair, and not because anything improved: this file grew 6,318 -> 6,616 lines, so five anchors that were safely past EOF came back INTO range and now land on plausible-looking wrong items. A dangling pointer degrades into a confident one as the file grows, which is the sharpest argument for the item-number convention. Root cause of the anchor class recorded, because it is not gradual drift: commit 4ea1501 (the master test plan) is not a descendant of 03f1fbd (the 185-item archival). Parallel branches, so anchors written against an 8,742-line ledger landed beside a commit that cut it to 3,858 -- stale on arrival. It also explains the anchor citing line 8429, absurd against 6,616 and ordinary against 8,742. The markdown-only scope note is discharged rather than left open. The predicted sweep of harness/, ide/src/, messagefoundry/, scripts/, tests/, packaging/ and .github/workflows/ ran over 1,219 files: 68 nonexistent paths, none of them a rotted citation -- test fixtures, withheld directories, and past-tense historical comments. The prediction was wrong and the reason is kept: citations in code are written about the past, prose citations are written as pointers. Three items filed, numbers allocated with alloc.ps1: #1098 -- the coordination hook prints a session UUID in the column a commit SHA occupies. Small, but it is an instrument answering a different question from the one its header asks, with nothing in the output saying so. #1099 -- #1094 says "the archival pass generates the anchor". There is no archival tooling at all; the move is manual. The sentence sits in the archive as settled record and points maintenance at a generator that was never built. #1100 -- the nine sites where the citing CLAIM is dead, not just the pointer, split out of #1095 rather than repointed. The alerting chapter still sets exit criteria requiring that #139 and PHI.md be made to agree when #139 was corrected 2026-08-01 and the code fixed by #323 on 2026-08-02. Converting those pointers would attach a durable reference to a false claim, which is worse than leaving the stale anchor visible. Found by the adversarial pass: every one was proposed as a clean repoint by a first reader and refuted by a second who checked the claim against the code rather than against the anchor.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Owner decision, 2026-07-30.
What changed
The Secure Development Standards stated that an independent ASVS-L3 review and DAST were "required before any off-loopback/production exposure". MessageFoundry is self-hosted, so that decision — and the assessment supporting it — belong to the implementing organization. The standard now records what has and has not been independently verified rather than gating deployment on it.
The engagement remains planned, at an estimated $25,000–$50,000, intended to be grant- or sponsor-funded rather than paid for out of licence revenue.
Why this PR exists
The same document is published in two places: here, and on the marketing site at
messagefoundry.org/docs/secure-development-standards.md. The website copy was updated first. Until this lands, the two published versions of the same standard contradict each other — one gates production deployment on an independent review, the other does not. The deviation bullet is now byte-identical in both.This repo's copy is the authoritative one, which is why the divergence needed closing rather than leaving the website as the odd one out.
Also fixed
The bullet cited
security/RELEASE-GATE.md. No such path exists in this repository, so the reference did not resolve for anyone following it. Removed.Bumped to v2.2 with a version-history entry. No change to the SSDF / ASVS / HIPAA mappings or Appendix A.
One thing for a maintainer, not fixed here
The signed risk-acceptance register that governs this residual is scoped by the same loopback restriction —
ASVS-HIPAA-Penalty.mddescribes it as "void on any off-loopback or production exposure". Its stated justification for having no third-party assessment is the loopback limit. With that restriction removed from the standard, the register likely wants re-scoping so the two agree.It lives in the maintainer-internal
docs/security/set, which is not present in this checkout, so it is untouched here — flagged rather than silently reconciled.🤖 Generated with Claude Code