docs(infra): security audit follow-ups — design + 4 implementation plans#514
Merged
Conversation
Four independent sub-projects from the post-#512 audit: 1. Devtime advisories — retry overrides on a regular branch (was bun worktree bug in #513), fall back to lockstep dep updates 2. osv-scanner CI job — independent advisory source via OSV database, scheduled weekly + on PRs/main 3. scap fork cleanup — re-test upstream main HEAD; if Linux now builds, drop the Detair fork; otherwise open a narrow upstream PR 4. CI #900/900 flake — root caused to CleanupGuard's no-timeout join in Drop. Stopgap (bounded join) + proper fix (#[must_use] type-state + explicit cleanup().await migration). Each topic gets its own implementation plan and PR. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
One plan per spec topic, all independent and shippable separately. Recommended implementation order (per spec): Topic 4 → 1 → 2 → 3. - 2026-04-11-cleanup-guard-test-flake.md (Topic 4, 14 tasks) — fix the CleanupGuard CI flake. Layer 1 stopgap (bounded join), Layer 2 explicit cleanup() method + ~136 test-site migration across 16 files, Layer 3 panic activation deferred to follow-up issue. - 2026-04-11-client-devtime-advisories.md (Topic 1, 5 tasks) — apply package.json overrides on a regular branch (not worktree, to avoid PR #513's bun bug). Plan A overrides + Plan B lockstep dep updates fallback + mermaid lazy-load investigation. - 2026-04-11-osv-scanner-ci.md (Topic 2, 2 tasks) — add osv-scanner job to existing security.yml. Pinned to v2.3.5 (no v2 floating tag exists upstream). HIGH+ severity gate. SARIF upload to Security tab. - 2026-04-11-scap-fork-cleanup.md (Topic 3, 3 tasks) — test if upstream CapSoftware/scap main HEAD now builds vc-client on Linux. If yes, drop Detair fork (Task 2). If no, open narrow upstream PR (Task 3, requires user authorization). All 4 plans peer-reviewed and approved by spec-document-reviewer. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documentation-only PR. Adds the design spec and 4 implementation plans for the remaining items from the post-#512 security audit.
Files
docs/superpowers/specs/2026-04-11-security-audit-followups-design.mddocs/superpowers/plans/2026-04-11-cleanup-guard-test-flake.mddocs/superpowers/plans/2026-04-11-client-devtime-advisories.mddocs/superpowers/plans/2026-04-11-osv-scanner-ci.mddocs/superpowers/plans/2026-04-11-scap-fork-cleanup.mdTopics
CleanupGuard::dropblocking join with no timeout. Stopgap (bounded join) + proper fix (explicitcleanup().awaitmigration across 16 files / ~136 sites)Recommended implementation order
Topic 4 → Topic 1 → Topic 2 → Topic 3.
Topic 4 first because it's actively blocking CI on every PR. Topic 2 depends on Topic 1 being green (so the new osv-scan job doesn't fail day 1).
Review process
Test plan
This is documentation only. No code changes, no test impact. The plans themselves contain the test plans for their respective implementations.
🤖 Generated with Claude Code