Fix: hand upload and rev approval lines name the person, not the user id; PLAN questions 53, 54 and the phase 10 note

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-30 18:18:41 -06:00
parent a5246e2aa5
commit 1cf37d94e7
6 changed files with 18 additions and 8 deletions
@@ -73,7 +73,7 @@ The brief's wording for the identity IDs, which the table follows: I4 and I7 are

 | ID | Requirement | Status | Owner |
 |---|---|---|---|
-| S1 | CSP, X-Frame-Options and related headers | Closed, phase 0, tuned phase 10 (the CSP pass; see "Headers"). | Dev |
+| S1 | CSP, X-Frame-Options and related headers | Closed, phase 0, tuned phase 10 (the CSP pass; see "Headers"; every e2e test fails on a CSP violation and one checks the served policy exactly). | Dev |
 | S2 | CSRF protection on every state-changing request | Closed, phase 1 (SameSite=Strict cookie, the Origin check, the `X-Requested-With` header). | Dev |
 | S3 | Dependency update and vulnerability scan | Closed, phase 9 (CI scanning on every run: `pip-audit` over every pin in `server/requirements.txt` fails on any known vulnerability; `npm audit --audit-level=high` fails on a high or critical one). Phase 10 bumped pypdf to 6.21.4, certifi to 2026.10.23 and pyasn1 to 0.6.5, and the scan is clean. | Dev |
 | S4 | Security review or penetration test before go-live | Deferred to IT: a penetration test of the production VM and the proxy before go-live, by IT or an outside firm. Who does it and when is TBD (Spencer decides). It is on the go-live checklist. If go-live goes ahead without it, Spencer records that decision on the checklist. | IT |