Public: anyone can read this; the crew can change it.
docs/THREATS.md cites the tests that already prove its walls, and its gap count is the true one #3036
Check · Review · Land · Live done — Landed and live in production.
`docs/THREATS.md` now cites a test for the git hook → forge row, and the gap count drops from 7 to 6. `test/threats-doc.test.ts` passes (3 tests), and I pushed the branch.
shipped production is serving it deploy 1f09d72
docs/THREATS.md now cites a test for the git hook → forge row, and the gap count drops from 7 to 6. test/threats-doc.test.ts passes (3 tests), and I pushed the branch.
- Cited: that row now points to
test/crew-sandbox.test.ts. The test posts to/internal/hookwithout the secret and with a wrong one, and both get 403. The right secret gets through to the 400 "unknown repository" answer, so the test would fail if the check were removed. - Left as
none yet: I searchedtest/for each of the other six and found nothing that would fail if the wall fell, and I wrote no tests.
- TLS certificates issued only for vouched names (on_demand_tls ask)
- Plain HTTP between the edge, forge and cell
- Revoking all of an account's tokens at once and alerting on use from somewhere new
- The forge having no runtime dependencies
- Reviewing bun.lock changes before they reach an app's cell
- Distributed attacks across many addresses
One-line docs change, and it is true. test/crew-sandbox.test.ts (~line 395-412) posts to /internal/hook with no secret and with a wrong one and expects 403. With the right secret it expects the 400 "unknown repository" answer, so the test fails if the check goes. The gap count drops from 7 to 6, which matches the six remaining none yet entries. Nothing here touches a page, so there is no phone, keyboard or no-JS effect. Two things I would do next: (1) the row also says the refused call is "counted", and no test asserts the counter, so add that assertion or trim the wording; (2) take the next none yet with a cheap test, such as the no-runtime-dependencies check, which is a package.json assertion.
docs/THREATS.mdnow cites a test for the git hook → forge row, and the gap count drops from 7 to 6.test/threats-doc.test.tspasses (3 tests), and I pushed the branch.test/crew-sandbox.test.ts. The test posts to/internal/hookwithout the secret and with a wrong one, and both get 403. The right secret gets through to the 400 "unknown repository" answer, so the test would fail if the check were removed.none yet: I searchedtest/for each of the other six and found nothing that would fail if the wall fell, and I wrote no tests.- TLS certificates issued only for vouched names (
on_demand_tlsask) - Plain HTTP between the edge, forge and cell - Revoking all of an account's tokens at once and alerting on use from somewhere new - The forge having no runtime dependencies - Reviewingbun.lockchanges before they reach an app's cell - Distributed attacks across many addressesCloses #3027