From d21283c5c98e1879f074f19ce71b4c583416adb8 Mon Sep 17 00:00:00 2001 From: Amar K P Date: Tue, 27 Oct 2026 22:50:50 +0530 Subject: [PATCH] docs(progress): record the PR #90 review fix in the stack log The review-fix commit 713735b was added after the PR #90 stack was recorded, so the follow-up section still described the PR as five layer commits plus one progress-bookkeeping commit (6 total) while the PR carries 7. Update the PR line and commit count to include the review fix, and note in the #86 entry that _resolve_redis_url() also hardens the Redis URL-splitting path per the Codex finding. --- docs/PROGRESS.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/PROGRESS.md b/docs/PROGRESS.md index e1a0f30..f5d20ea 100644 --- a/docs/PROGRESS.md +++ b/docs/PROGRESS.md @@ -497,10 +497,10 @@ This document tracks execution progress across all backlog tasks, including pull ### PR #84 Follow-ups (#85–#89) - **Status**: Done -- **PR**: stacked on `main` — PR #90 (five layer commits plus one progress-bookkeeping commit) -- **Commits**: 5 +- **PR**: stacked on `main` — PR #90 (five layer commits, plus one review-fix and one progress-bookkeeping commit) +- **Commits**: 5 (6 including the review-fix commit from the Codex review) - **Notes**: - - **#86 (guard correctness)** — `scripts/check_deploy_credentials.py` applied the weak-password policy only to the `POSTGRES_*` and `REDIS_PASSWORD` components. An explicit URL that carried its own userinfo bypassed it: `DATABASE_URL` was checked only against the exact known-password set, the read-only URL was never policy-checked, and `REDIS_URL` was checked for presence alone, so `redis://:short@host` passed the 12-character rule. `audit_credentials()` now resolves each URL exactly as `Settings` does and applies `_is_weak_password()` to URL-supplied secrets, requires a password in an explicit URL, validates a component whenever it is set but requires it only when it is the resolution source, and parses each URL once through a helper that reports "is not a valid connection URL" rather than leaking a SQLAlchemy traceback or the secret. `docs/DEPLOY.md` describes both credential forms. + - **#86 (guard correctness)** — `scripts/check_deploy_credentials.py` applied the weak-password policy only to the `POSTGRES_*` and `REDIS_PASSWORD` components. An explicit URL that carried its own userinfo bypassed it: `DATABASE_URL` was checked only against the exact known-password set, the read-only URL was never policy-checked, and `REDIS_URL` was checked for presence alone, so `redis://:short@host` passed the 12-character rule. `audit_credentials()` now resolves each URL exactly as `Settings` does and applies `_is_weak_password()` to URL-supplied secrets, requires a password in an explicit URL, validates a component whenever it is set but requires it only when it is the resolution source, and parses each URL once through a helper that reports "is not a valid connection URL" rather than leaking a SQLAlchemy traceback or the secret. `docs/DEPLOY.md` describes both credential forms. A review-fix commit (`713735b`) extends the same contract to `REDIS_URL`: `apply_redis_password()` splits the URL with `urlsplit()` before the audit parses anything, so `_resolve_redis_url()` now catches that `ValueError` (a malformed IPv6 authority such as `redis://[broken`) and reports it as an invalid URL instead of crashing. - **#87 (logging)** — `main()` emits the header and one `ERROR` record per problem through `logging.getLogger(__name__)`; `basicConfig()` is confined to the `__main__` block so importing the module has no side effects. Exit code and message text are unchanged, and a test pins the no-`print()` rule from `AGENTS.md`. - **#85 (test reliability)** — `tests/real/test_sql_isolation_real.py::readonly_engine` no longer converts `provision_readonly_role()` failures into `pytest.skip`. The upstream `real_database_url` fixture already applies migrations and fails loudly when PostgreSQL is unreachable, so a provisioning error is a defect and now turns CI red instead of leaving the isolation tier green-by-skip. - **#88 (docs)** — `docs/AUDIT.md` records the canonical "linear 12-layer stack, merged as 14 commits (12 layer commits plus two progress-bookkeeping commits)" wording instead of "nine branches", and the historical M4-T04 row describes the lexer plus dedicated read-only role instead of "Strict SELECT AST validation". `tests/unit/test_docs_accuracy.py` guards both claims.