amadan
ledger
1 file changed,
+5
−0
.superpowers/sdd/2026-08-23-idear/progress.md+5 −0
diff --git a/.superpowers/sdd/2026-08-23-idear/progress.md b/.superpowers/sdd/2026-08-23-idear/progress.md| index 56d04e0..5d54e04 100644 |
| --- a/.superpowers/sdd/2026-08-23-idear/progress.md |
| +++ b/.superpowers/sdd/2026-08-23-idear/progress.md |
| @@ -99,3 +99,8 @@ Task 5: Ruling: fix all four Importants and M1-M6. |
| I1: the limiter's one anti-spoofing property (ignoring X-Forwarded-For) is stated in a doc comment and tested nowhere. |
| Cost if wrong on any: bounded — each is a small, local change with a test attached. |
| Task 5: fix round 1 dispatched (resume original implementer, opus), FIX_BASE 613642e |
| +Task 5: fix round 1/5 (4 Important + 6 Minor addressed; commits 613642e..a909990). Re-reviewer independently probed every IPv6 form and confirmed NO ::ffff: representation falls through to the /64 fold, so the "every IPv4 client in one bucket" risk the fix could have introduced does not occur. I3 and I4 reproduced by mutation. |
| +Task 5: minor (deferred): TestEveryHandlerIsMounted asserts a COUNT, not identity — it would miss one route dropped and an unrelated handler-shaped method added in the same change. A `Name` field on Route compared against reflected method names would close it. TestRoutesMatchTheDesign pins the table against the spec independently, which covers most of the gap. Final review to triage. |
| +Task 5: minor (deferred): an empty or portless RemoteAddr keys to "" and shares a bucket; not attacker-reachable, since net/http always populates RemoteAddr. |
| +Task 5: complete (commits ff6fafa..a909990, review clean) |
| +Task 6: dispatched (opus), BASE a909990 — the example app and SKILL.md, the last task |