amadan
ledger
1 file changed,
+8
−0
.superpowers/sdd/2026-08-23-idear/progress.md+8 −0
diff --git a/.superpowers/sdd/2026-08-23-idear/progress.md b/.superpowers/sdd/2026-08-23-idear/progress.md| index 914c286..56d04e0 100644 |
| --- a/.superpowers/sdd/2026-08-23-idear/progress.md |
| +++ b/.superpowers/sdd/2026-08-23-idear/progress.md |
| @@ -91,3 +91,11 @@ Task 5: dispatched (opus), BASE ff6fafa — HTTP handlers + the reconciliation r |
| Task 5: implemented DONE_WITH_CONCERNS (613642e). Controller re-verified: suite green, -race green. |
| Task 5: Ruling (spec self-contradiction on NotFound): REAFFIRMED — the hook lives on idear.Config only. The spec's §5 snippet passes NotFound to NewHandlers, but Require is a Roster method and cannot read a HandlerConfig; two hooks would mean two 404 renderers in one mount, which is the exact oracle §5 exists to prevent. This was already ruled in the plan's preamble before Task 1; the implementer was right to re-flag it rather than assume. Cost if wrong: a field move. |
| Task 5: noted — tests were written AFTER the handlers, not red-first. The implementer disclosed it rather than glossing. Its argument (a suite against an absent handlers.go fails to compile, proving nothing) is only half right — stubs would have allowed red-first — so the mutation battery is now the only evidence coverage is real, and the reviewer is being told to verify it rather than accept the table. |
| +Task 5: review — spec ✅, quality Needs work: 0 Critical, 4 Important, 6 Minor. Reviewer ran 21 mutations (5 survivors) and independently reproduced 12 rows of the implementer's own table; every row matched. The after-the-fact test writing did NOT translate into fake coverage. |
| +Task 5: Ruling: fix all four Importants and M1-M6. |
| + I2 is the most serious: clientIP keys on the FULL address, so any host with an IPv6 /64 — universal — rotates source addresses for free and gets a fresh burst each time, and 4096 of them fill the table, after which `allow` fails closed and refuses EVERY unseen client. That locks out orphans, whose only healing path is POST /invitations/{token}. Fail-closed is the right direction; the key is the bug. Fold to /64 (IPv6) and /32 (IPv4). |
| + I3 is the most instructive: TestGrantableIsTheAllowList derives its expectation from checkInviteRole via Grantable, so changing `>=` to `>` — letting an Admin mint a peer Admin, a real escalation — leaves EVERY test in handlers_test.go green. This is the brief's own anti-pattern in mirror form: total derivation buys drift-resistance and loses rule-change detection. Fix with a spec-quoted map compared both ways, the way TestRoutesMatchTheDesign already does. |
| + I4: standing() can be forced to (false,false) with the suite green, which makes item 9's healing path unreachable from any real UI while the tests report success. |
| + I1: the limiter's one anti-spoofing property (ignoring X-Forwarded-For) is stated in a doc comment and tested nowhere. |
| +Cost if wrong on any: bounded — each is a small, local change with a test attached. |
| +Task 5: fix round 1 dispatched (resume original implementer, opus), FIX_BASE 613642e |