J3vbandClaude Fable 5 7c38c2bd1e fix(b3-1): Codex P2s — guaranteed-invalid TOTP code, B3-9 scope, hp-0 breakdown ...

- wrongTOTPCode derives a code outside the three accepted steps instead of
  assuming "000000" is invalid (1-in-333k flake in the per-user cap row)
- OC-0376/0377/0378 added to B3-9 in the step table and its section
- hp-0 open-record breakdown recomputed for the 59-open ledger

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg9QQWVN3E5UUgBD2dydtu

2026-08-29 20:50:13 +02:00

..

admin

feat(b2-6): safe audit coverage (S-02) (#1441)

2026-08-29 11:11:37 +02:00

api

fix(b3-1): Codex P2s — guaranteed-invalid TOTP code, B3-9 scope, hp-0 breakdown

2026-08-29 20:50:13 +02:00

auth

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

cmd

feat(b3-0): boundary inventory — dbinventory tool, db-import-boundary rule, server-boundaries.md (#1448)

2026-08-29 20:07:15 +02:00

config

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

db

feat(b2-6): safe audit coverage (S-02) (#1441)

2026-08-29 11:11:37 +02:00

diskutil

infra: observability, backups, guardrails, and deployment hardening (#1376)

2026-08-15 20:50:47 +02:00

invariants

feat(b3-0): boundary inventory — dbinventory tool, db-import-boundary rule, server-boundaries.md (#1448)

2026-08-29 20:07:15 +02:00

logctx

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

migrations

infra: observability, backups, guardrails, and deployment hardening (#1376)

2026-08-15 20:50:47 +02:00

permissions

feat(b2-5): one permission predicate per security property (#1440)

2026-08-29 07:07:04 +00:00

plugin

fix(b2-8): close the nine B2-tagged ledger findings (#1436)

2026-08-28 15:13:49 +00:00

scripts

chore(b2-0): release hygiene (#1434)

2026-08-28 10:16:27 +02:00

service

feat(b2-6): safe audit coverage (S-02) (#1441)

2026-08-29 11:11:37 +02:00

stackutil

feat(server): logging & error-visibility hardening

2026-07-24 11:07:12 +02:00

storage

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

syncutil

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00

telemetry

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

updater

feat(b2-2): protocol epoch and negotiation (slim) (#1438)

2026-08-29 07:23:06 +02:00

ws

chore(bughunt): record the 2026-08-29 hunt in the findings ledger (#1442)

2026-08-29 10:27:36 +00:00

.air.toml

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

.dockerignore

B1-6: generated artifacts (RL-06 / L-06, RL-07 / L-07, RL-08 / L-08) (#1418)

2026-08-27 11:08:07 +02:00

.env.example

feat: add docker-compose with LiveKit for server Docker deployment

2026-04-03 14:32:20 +02:00

.golangci.yml

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

.gremlins.yaml

B1-3: repository hygiene gates (RL-19 / L-13, S-05) (#1414)

2026-08-26 18:00:26 +00:00

addrinuse_test.go

fix(server): drain fully before the self-update/restore restart handoff (#1380)

2026-08-16 08:25:40 +02:00

addrinuse_unix.go

fix(server): drain fully before the self-update/restore restart handoff (#1380)

2026-08-16 08:25:40 +02:00

addrinuse_windows.go

fix(server): drain fully before the self-update/restore restart handoff (#1380)

2026-08-16 08:25:40 +02:00

addrinuse.go

fix(server): drain fully before the self-update/restore restart handoff (#1380)

2026-08-16 08:25:40 +02:00

CLAUDE.md

feat(b3-0): boundary inventory — dbinventory tool, db-import-boundary rule, server-boundaries.md (#1448)

2026-08-29 20:07:15 +02:00

docker-compose.otel.yml

B1-3: repository hygiene gates (RL-19 / L-13, S-05) (#1414)

2026-08-26 18:00:26 +00:00

docker-compose.yml

B1-3: repository hygiene gates (RL-19 / L-13, S-05) (#1414)

2026-08-26 18:00:26 +00:00

Dockerfile

chore: merge main into dev after the v1.2.0-alpha.4 release (#1432)

2026-08-28 08:18:24 +02:00

go.mod

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

go.sum

build: toolchain and dependency upgrades (TypeScript 6, Node 24 CI, Vite 8, Vitest 4, Go/Rust deps) (#1401)

2026-08-22 06:48:58 +02:00

listen_retry.go

fix(server): drain fully before the self-update/restore restart handoff (#1380)

2026-08-16 08:25:40 +02:00

livekit.yaml.example

feat(server): support dual-homed voice hosts and user-managed livekit.yaml

2026-07-19 10:50:11 +00:00

main_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

main.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

Makefile

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

prometheus.dev.yml

B1-3: repository hygiene gates (RL-19 / L-13, S-05) (#1414)

2026-08-26 18:00:26 +00:00

restart_test.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

restart.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00

sqlc.version

feat: adopt sqlc for type-safe database access (Phase A Step 2)

2026-04-06 09:12:59 +02:00

sqlc.yaml

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00

token_cli.go

B1-5: ownership moves (RL-09 / L-09, RL-10 / L-10, RL-11 / L-11, RL-13 / L-12) (#1417)

2026-08-27 07:11:18 +02:00