lprintf/printf
1
0
Fork 0
Code Issues 3 Pull requests Projects Releases Packages Wiki Activity Actions

[codex] clarify Wave 3 review paths and security boundaries #21

Merged
lprintf merged 1 commit from codex/clarify-wave3-review-paths into main 2026-08-06 20:54:34 +08:00
Conversation 0 Commits 1 Files changed 10 +360 -2
lprintf commented 2026-08-06 19:06:22 +08:00
Owner
Copy link

What changed

  • add a bilingual single-review Runbook for the two independent publication paths and Hub discovery
  • add a bilingual response to the Wave 3 cross-review findings
  • link the review entry from both READMEs and delivery guides
  • document shared-OIDC/UID plans and tiered URL ownership without treating planned work as current state

Why

The current material explains all three products, but a short review still requires readers to assemble the path and evidence across several documents. Issues #19 and #20 also exposed ambiguity around lprintf security claims and the portable Printf Agent's --public-base option.

Product and security impact

  • Printf static publication and lprintf full-application publication are explicitly independent paths.
  • Hub receives final URLs and does not control either runtime.
  • Compose Bridge's zero host HTTP port practice is separated from remaining application-layer and L7 risk.
  • High-defense nodes and automatic multi-node switching are described as DDoS/availability mitigation that still needs versioned drill evidence.
  • --public-base is identified as a portable Printf release-plan evidence boundary, not an lprintf mapping target restriction.
  • Planned shared OIDC UID keeps Clients, Sessions, roles, databases, runtimes, and publication state separate.
  • Platform-owned URL verification is distinguished from non-mandatory third-party URL ownership checks and later correction.

Checks

  • uv run --python 3.11 python -m unittest discover -s tests -v (4 tests passed)
  • parsed all 6 repository JSON files with Python 3.11
  • checked local links in all 10 changed Markdown files
  • git diff --cached --check

Refs #19, #20

This documentation PR does not close the portable-Agent code defects described in #20. Those items remain open until implementation and tests are merged.

## What changed - add a bilingual single-review Runbook for the two independent publication paths and Hub discovery - add a bilingual response to the Wave 3 cross-review findings - link the review entry from both READMEs and delivery guides - document shared-OIDC/UID plans and tiered URL ownership without treating planned work as current state ## Why The current material explains all three products, but a short review still requires readers to assemble the path and evidence across several documents. Issues #19 and #20 also exposed ambiguity around lprintf security claims and the portable Printf Agent's `--public-base` option. ## Product and security impact - Printf static publication and lprintf full-application publication are explicitly independent paths. - Hub receives final URLs and does not control either runtime. - Compose Bridge's zero host HTTP port practice is separated from remaining application-layer and L7 risk. - High-defense nodes and automatic multi-node switching are described as DDoS/availability mitigation that still needs versioned drill evidence. - `--public-base` is identified as a portable Printf release-plan evidence boundary, not an lprintf mapping target restriction. - Planned shared OIDC UID keeps Clients, Sessions, roles, databases, runtimes, and publication state separate. - Platform-owned URL verification is distinguished from non-mandatory third-party URL ownership checks and later correction. ## Checks - `uv run --python 3.11 python -m unittest discover -s tests -v` (4 tests passed) - parsed all 6 repository JSON files with Python 3.11 - checked local links in all 10 changed Markdown files - `git diff --cached --check` Refs #19, #20 This documentation PR does not close the portable-Agent code defects described in #20. Those items remain open until implementation and tests are merged.
lprintf changed title from [codex] clarify Wave 3 review paths and security boundaries to WIP: [codex] clarify Wave 3 review paths and security boundaries 2026-08-06 19:06:48 +08:00
lprintf changed title from WIP: [codex] clarify Wave 3 review paths and security boundaries to [codex] clarify Wave 3 review paths and security boundaries 2026-08-06 20:54:09 +08:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lprintf/printf!21
No description provided.