base-layer/promptkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Record final validation and repair audit links

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-05 20:19:06 +00:00
parent 96c619f7d4
commit 5ee602cc4b
13 changed files with 168 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
docs/roadmap/audit/05-resources.md
View File

@@ -30,9 +30,9 @@ existing protected behavior; they do not cover all findings below.
**Priority:** P2. Unbounded remote-response consumption; a finite limit would be
a new policy decision, not enforcement of an existing documented byte limit.
**Code:** [runOpenRouterKey](../../../internal/usecase/smoke_authentication.go:66),
[recognizedOpenRouterKeyResponse](../../../internal/usecase/smoke_authentication.go:139),
and [diagnostic HTTP execution](../../../internal/llm/http_evidence.go:129).
**Code:** [runOpenRouterKey](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/internal/usecase/smoke_authentication.go#L66),
[recognizedOpenRouterKeyResponse](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/internal/usecase/smoke_authentication.go#L139),
and [diagnostic HTTP execution](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/internal/llm/http_evidence.go#L129).
**Circumstances:** An authentication endpoint returns HTTP 200 with a large or
continuously growing body. Recognition calls unrestricted `io.ReadAll` and then
@@ -63,10 +63,10 @@ artifacts, or generated output.
**Priority:** P2. Potentially exponential allocation before upstream resource
checks can run.
**Code:** [providerMapForMapping](../../../provider_values.go:19),
[providerValueForMapping](../../../provider_values.go:31),
[ProfileSource](../../../profiles.go:33), and
[BackendSource](../../../backends.go:100).
**Code:** [providerMapForMapping](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/provider_values.go#L19),
[providerValueForMapping](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/provider_values.go#L31),
[ProfileSource](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/profiles.go#L33), and
[BackendSource](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/backends.go#L100).
**Circumstances:** A caller builds a small acyclic Go value graph containing
repeated map/slice references. Each level can point twice to the same child:
@@ -107,10 +107,10 @@ configuration limits to fix this pre-handoff allocation problem.
**Priority:** P3. Avoidable retained-memory dependency after use/discard.
**Code:** [PreparedExecution.owner](../../../internal/usecase/prepared_execution.go:24),
[Discard](../../../internal/usecase/prepared_execution.go:96),
[claim](../../../internal/usecase/prepared_execution.go:172), and
[payload clearing](../../../internal/usecase/prepared_execution.go:188).
**Code:** [PreparedExecution.owner](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/internal/usecase/prepared_execution.go#L24),
[Discard](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/internal/usecase/prepared_execution.go#L96),
[claim](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/internal/usecase/prepared_execution.go#L172), and
[payload clearing](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/internal/usecase/prepared_execution.go#L188).
**Circumstances:** A consumer retains a completed or discarded handle for its
supported `Details` access, while replacing or dropping the originating engine.
@@ -141,7 +141,7 @@ collaborators is implied.
**Priority:** P3. Avoidable memory amplification on validation failures.
**Code:** [formatRepairDiagnostics](../../../internal/usecase/repairer.go:119).
**Code:** [formatRepairDiagnostics](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/internal/usecase/repairer.go#L119).
**Circumstances:** A failed schema validation produces a large diagnostic or many
diagnostics and repair is enabled. The formatter normalizes every string, marshals
@@ -170,9 +170,9 @@ implementation opportunity, not a claim that the existing contract promises a
**Priority:** P3. Avoidable backing-buffer retention in retained metadata.
**Code:** [NormalizeSessionID](../../../internal/domain/session.go:10),
[preparation](../../../internal/usecase/runner.go:312), and
[prepared metadata construction](../../../internal/usecase/runner.go:491).
**Code:** [NormalizeSessionID](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/internal/domain/session.go#L10),
[preparation](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/internal/usecase/runner.go#L312), and
[prepared metadata construction](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/fb87fab/internal/usecase/runner.go#L491).
**Circumstances:** A direct or rendered session ID contains substantial leading
or trailing whitespace around a short valid identifier. `strings.TrimSpace`