Record accepted audit remediation decisions

docs/roadmap/audit.md

@@ -1,11 +1,11 @@
-# Consolidated audit recommendations
+# Audit remediation roadmap
 
 Reviewed against `91f25c4` on `main`. All eleven reports under
 [`audit/`](audit/) were reviewed, with selected implementation and contract
 checks. Changes since their earliest baseline affect audit documents only;
 the recorded implementation findings remain pending. This document owns the
-consolidated recommendations. The individual reports retain detailed evidence
-and reproduction limits.
+accepted remediation priorities and approaches. The individual reports retain
+detailed evidence and reproduction limits.
 
 The 27 findings across the reports consolidate into 20 work items. Missing
 regressions accompany the defects they should protect. Repeated reports of
@@ -13,15 +13,30 @@ subprocess shutdown and Git inspection duplication each become one work item.
 Temporary-storage fixes and unused-helper removals are grouped by ownership,
 with their distinct cases identified below.
 
+## Accepted decisions and status
+
+The approaches and priorities for A01–A20 are accepted. Implementation remains
+pending. Each recommendation below records the accepted approach;
+alternatives are retained as decision rationale.
+
+- A01–A04 are the first implementation priorities.
+- A08 uses an internal limit of ten followed redirects per asset request.
+- A10 retains a 1 MiB diagnostic tail for status-only Go commands while
+  forwarding complete output and preserving full `Tool.Output` results.
+- A11 response caps and A17 exclusion indexing remain deferred pending the
+  sizing and benchmark evidence described in those items.
+- Internal consolidation and refactoring follow the timing stated in their
+  accepted approaches, alongside related repairs or maintenance.
+
 ## Priorities
 
-Priority indicates recommended work order, independent of the original audits'
+Priority indicates accepted work order, independent of the original audits'
 severity labels. P1 addresses release integrity, credential confidentiality,
 and cancellation guarantees. P2 improves recovery, completed-output contracts,
 cleanup, and bounded asset inspection. P3 covers focused internal improvements.
 P4 defers implementation pending sizing or performance evidence.
 
-| ID | Priority | Work and recommended disposition |
+| ID | Priority | Accepted work and disposition |
 | --- | --- | --- |
 | A01 | P1 | Force the intended tag push to include the repository itself. |
 | A02 | P1 | Use original Git objects consistently for release evidence. |
@@ -199,11 +214,11 @@ requiring hostile filesystem actors or power-loss guarantees.
 Source: [security §2](audit/07-security.md#2-medium-unique-asset-redirects-bypass-the-http-clients-finite-redirect-limit),
 also referenced by the resource audit.
 
-**Recommendation:** Propose ten followed redirects per asset request as the
-initial internal default, matching the ordinary Go client convention, and
+**Recommendation:** Allow up to ten followed redirects per asset request as
+the initial internal default, matching the ordinary Go client convention, and
 report exhaustion as unverifiable content. Preserve exact-cycle detection,
 body closure, and per-origin authorization checks. This bounds both request
-count and retained URL history. It is an explicit proposed policy choice;
+count and retained URL history. The ten-redirect budget is accepted;
 assess a longer-chain override only for demonstrated consumer requirements.
 
 **Alternative:** Rely on an operation deadline. It preserves arbitrary chain
@@ -237,9 +252,9 @@ Source: [resources §1](audit/05-resources.md#1-go-command-output-is-retained-fo
 
 **Recommendation:** For status-only `Tool.Run` and dependency preparation,
 forward the complete stream while retaining a bounded diagnostic tail for
-failure reporting. Start with a proposed 1 MiB internal tail and an explicit
-truncation notice; keep full output for `Tool.Output` consumers. This is a
-deliberate change to diagnostic retention, to be documented with implementation.
+failure reporting. Retain up to 1 MiB internally with an explicit truncation
+notice; keep full output for `Tool.Output` consumers. This accepted change to
+diagnostic retention will be documented with implementation.
 It bounds memory without adding consumer configuration or disk lifecycle work.
 
 **Alternative:** Spool full diagnostics to owned temporary storage. This retains
@@ -434,7 +449,7 @@ other audits supply supporting context rather than additional work items.
 
 ## Verification and scope of follow-up
 
-This consolidation adds recommendations and changes no production behavior.
+This roadmap records accepted work; production behavior remains unchanged.
 Original reproductions, source inspection findings, coverage figures, and
 scanner results retain their stated limits. Existing passing tests establish
 a useful baseline; regressions should demonstrate the behavior of each repaired
@@ -444,5 +459,5 @@ implementation changes warrant them.
 
 Keep the two public facades, explicit forge selection, caller ownership of
 prebuilt artifacts, original credential origin checks, and additive delivery
-semantics. The proposed diagnostic/redirect budgets are deliberate recommendations;
+semantics. The diagnostic and redirect budgets above are accepted decisions;
 JSON limits and exclusion indexing remain deferred as explained above.