ASVS V3 is in scope — the exclusion contradicted the scorecard

[wshallwshall]

Stacked on #104. Merge order: #98 → #100 → #101 → #103 → #104 → this.
Closes the documentation audit at 65 of 65.

What

The Secure Development Standards excluded ASVS 5.0 chapter V3 (Web Frontend Security) on the
stated grounds that no browser-delivered UI exists:

| V3 | Web Frontend Security | **No** | No browser-delivered UI (PySide6 desktop + APIs);
  documented exclusion. Re-scope if a web/admin UI is added |

Both halves of that premise are dead — BACKLOG #103 deleted the PySide6 desktop console on
2026-07-13 and made the browser console at /ui the sole operator UI; ADR 0143 defaulted it on
2026-07-21. The row's own re-scope trigger had fired.

Why this is a doc fix, not a scoping decision

That argument is not what settles it. The exclusion was never carried into the scoring lineage.

ASVS-L3-ASSESSMENT-MERCY-2026-07-22.md:459 scores a full ## V3 — Web Frontend Security chapter —
31 cells, with code anchors — and contains no V3 exclusion claim anywhere. The older assessments
(ASVS-L3-ASSESSMENT-2026-07-09.md, ASVS-L3-ASSESSMENT.md) have no V3 chapter at all.

So the exclusion was genuine historically, was abandoned in scoring, and the prose never caught up.
This row was the last place it survived — contradicting the scorecard it purports to summarize.
Correcting it moves no requirements and changes no denominator.

Reaching that evidence needed a detour worth recording: docs/security/ is gitignored in the
working tree, so earlier passes reported it unreadable. The engine clone carries it on 466
vaultall/* refs, which is how it was read directly rather than taken on report.

What changed

Both the row and the chapter roll-up that restates it — fixing one alone would leave the other
asserting the opposite. V17 (WebRTC) remains a sound exclusion and is now the only one.

The row now cites the console's shipped controls rather than a verdict:

Control	Verified in
Per-response nonce CSP, script-src 'nonce-…' 'strict-dynamic'	_security.py:9-10
COOP / CORP same-origin	_security.py:12-13
HttpOnly SameSite=Strict session cookie, __Host--prefixed + Secure on effective-https	_auth.py:325, _security.py:23-25
Server-side Sec-Fetch-Site / Origin check on state-changing /ui POSTs	_auth.py:146,304

frame-ancestors 'none' was in the draft wording and is not asserted — I could not find it in
the console source, so it was dropped rather than shipped unverified.

No count is published

Per the standing no-numbers policy, and it matters more than usual here. 175/50/2/118 is
superseded twice over — that was the retired A/B-posture figure, and its N/A count of 118 against
today's 61 is the measure of how much moved into scope when the split was dropped.

V3's own tally has moved three times since the assessment that settles this PR, which is the best
argument for not printing one: 23 Pass / 4 Partial / 0 Fail / 4 N/A across 31 cells at 2026-07-22
(read directly); 3.5.1 and 3.7.5 flipped to Pass in the 2026-07-24 interim (PR #286, verified);
3.4.1 was downgraded to Partial in the 2026-07-31 re-anchor — giving 24 / 3 / 0 / 4, still 31
cells. The scope claim depends on none of it, and the rendered PDF was checked to confirm no tally
leaked in.

Also corrected in passing: the roll-up's arithmetic was already wrong. "12 chapters active
(V1, V2, V4–V8, V11–V16)" is 13. With V3 it is 14.

Verification

• Rendered PDF re-checked: v0.3.2 / July 2026, zero mojibake, zero local file:// links.
• No browser-delivered UI and Documented exclusions: V3 both confirmed absent from the
  rendered artifact; the new in-scope wording confirmed present.
• Document swept for other V3-exclusion references — none remain; the only other mention is the
  neutral 17-chapter list.
• No site HTML asserts V3 or the exclusion set (the one grep hit is SVG path data).

🤖 Generated with Claude Code