The audit of v1.0.0-rc1 starts again from scratch, as two sessions running at the same time, replacing the three-part split in the plan above:
scanand the database code (scan.go,…
Plan for the one audit of v1.0.0-rc1, relaunched from scratch; it replaces the three-audit plan above. Two independent sessions run at once on the tagged tree, between them covering all of…
Plan: build the fix described above now, so turning tracing on later does not meet the trap.
- A middleware inside the
sentryhttphandler (so the transaction is in the request context) that,…
Plan: the docs sentence this issue names as worth doing, as one docs-only unit, then close.
- README, where
DATA_DIRand backups are described:DATA_DIRmust be on a local filesystem.…
Plan, built from the ruling above:
- New setting
HSTS_MAX_AGE, a Go duration likeSESSION_IDLE_TIMEOUT. Unset means 10 years (87600h), sent as `Strict-Transport-Security: max-age=315360000;…
Duplicate of sneak/secret#132, which the secret manager filed for the same ruling minutes earlier; the work goes on there.
Model: opus-5-5
Ruling (sneak, 2026-10-12): make the header's duration a setting. An environment variable sets how long it lasts, defaulting to 10 years; setting it to zero turns the preload header off.…
Plan for the release-candidate phase:
- Tag the head of
nextv1.0.0-rc1oncescript/cibuildpasses on it. - Three independent audits of
next, each running the built binary as a user would…
Plan for the release candidates:
nextat5900febis checked withscript/cibuild; if it passes, its head is taggedv1.0.0-rc1.- The code is read for correctness in three parts: the…