base-layer/promptkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Record final validation and repair audit links

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-05 20:19:06 +00:00
parent 96c619f7d4
commit 5ee602cc4b
13 changed files with 168 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docs/roadmap/audit/07-security.md
View File

@@ -62,10 +62,10 @@ operations described below rather than inferred from interface-call traces.
**Priority:** P2. Build/deployment security finding, not a newly discovered
PromptKit algorithm defect.
**Relevant code:** [declared Go minimum](../../../go.mod:3),
[default HTTP-client construction](../../../internal/llm/openai_compatible_client.go:58),
[generation dispatch](../../../internal/llm/openai_compatible_client.go:211), and
[diagnostic dispatch](../../../internal/llm/http_evidence.go:129).
**Relevant code:** [declared Go minimum](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/cf0bfd4/go.mod#L3),
[default HTTP-client construction](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/cf0bfd4/internal/llm/openai_compatible_client.go#L58),
[generation dispatch](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/cf0bfd4/internal/llm/openai_compatible_client.go#L211), and
[diagnostic dispatch](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/cf0bfd4/internal/llm/http_evidence.go#L129).
**Condition and impact:** The local toolchain used for this audit is Go 1.27.0.
Applications built with that patch can exercise affected standard-library
@@ -111,9 +111,9 @@ HTTP/2 ban, or a new recurring release gate.
response boundary. This is the same mechanism as resource-management audit
finding 1, not a second independent remediation item.
**Relevant code:** [authentication recognition](../../../internal/usecase/smoke_authentication.go:139),
[authentication probe execution](../../../internal/usecase/smoke_authentication.go:66),
and [diagnostic HTTP execution](../../../internal/llm/http_evidence.go:129).
**Relevant code:** [authentication recognition](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/cf0bfd4/internal/usecase/smoke_authentication.go#L139),
[authentication probe execution](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/cf0bfd4/internal/usecase/smoke_authentication.go#L66),
and [diagnostic HTTP execution](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/cf0bfd4/internal/llm/http_evidence.go#L129).
**Condition:** A consumer explicitly invokes an `openrouter_key` authentication
diagnostic. The selected endpoint, a compromised provider, or an intermediary