Repository navigation
Strengthen hosted-server verification with risk-based boundary checks - #9
Merged
ancsingabor merged 2 commits intoNov 2, 2026
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Strengthen hosted-server verification with 75 cases across three risk-selected groups: HTTP ownership, cookie/origin/input boundaries, and native-process framing/error propagation. Extend the existing suites and document what their observations establish and their limits. Include the feature specification, plan and completed task record.
Application runtime code, dependency manifests, native interfaces and deployment configuration are unchanged.
Validation: a separately approved final SpecGuard attempt passed all six entries: 113 server tests (including the 75 selected cases), Python compatibility, usage browser, Chromium/Firefox/WebKit runtime browser checks, production-scope dependency audit (zero reported vulnerabilities), and diff hygiene.
The initial attempt failed on verification configuration/copy preparation: npm loaded the same config path twice, and the isolated copy dereferenced symbolic links. Those records were preserved privately; separately authorized corrections and a fresh approved attempt resolved both blockers without application remediation. Raw evidence and private configuration are excluded from this PR.
Limits: synthetic native fixtures and mocked Python operation bridge; no real-corpus, production-proxy or Linux resource-limit acceptance claim. The assessment recommends good enough to close within the agreed finite scope; maintainer acceptance remains separate.