[0xfauzi]

This change follows #128, #129 and #130. A second security review examined the code that the audit fixes added. This change fixes the confirmed findings of that review. It also makes the strict route search faster.

Security review of the new code

Three finders examined the new code, and a verifier for each finder tried to disprove each finding. There are 17 findings, and the verifiers disproved none. All are low or info severity.

Fixed, each with a regression test that fails on the old code:

• git-sec-1: a promisor remote in .git/config started a lazy fetch during a read. Each Git command now gets GIT_NO_LAZY_FETCH=1 and an empty GIT_ALLOW_PROTOCOL.
• git-sec-2: a fork PR could change out_dir or the figure paths in systemap.toml, and the base-render job then did not check the figures. The job now refuses a PR that changes those settings, and render --check also compares the figure files that exist.
• post-server-1: a page of a different web site could fill the 32 /events slots. The servers now refuse a cross-site GET request for /events.
• post-server-2: systemap serve copied the CSP meta content of a served file into a response header without a check. The value is now checked.
• post-server-4: the served pages now have frame-ancestors 'none'.
• SEC-1: the tracked-cache refusal failed open when Git could not list the index. It now refuses the cache file.
• SEC-2: the fact cache could keep the facts of one read with the digest of a different read. The cache now parses the same text that it digests.
• SEC-3: facts_shape now refuses a stored module without a sha value.
• SEC-4, SEC-5, SEC-8: newlines, control characters and bidirectional controls in stored names cannot make a false line, and the terminal output shows them as escapes.
• SEC-6: decisions submit refuses a deeply nested results file with an error, not a RecursionError.

Not fixed, with the traced reason:

• git-sec-3: on Windows, core.hooksPath=nul is a relative path. A Windows measurement is necessary before a change.
• git-sec-4: the pre-commit hook pins are tags, because .pre-commit-config.yaml must stay byte-identical with its copies. The pin belongs in the source of the copies.
• git-sec-5: the scaffold template pins uv and systemap. systemap has no other dependencies.
• post-server-3: no current sink exists.
• SEC-7: plausible only. It needs a file system with a coarse change time.

Route search

route_astar.py adds an A* search with an admissible cut bound. The routes are byte-identical on this repository and on the s36, s72 and s144 fixtures, and the figures do not change.

route_all, 3 runs each:

Map	Before	After
s72	2.39-2.43 s	0.95-1.10 s
s144	9.00-9.28 s	4.18-4.25 s

The time still grows with the square of the number of flows (exponent 1.93-2.16). The target was less than 4 s at s144, and this change does not satisfy it.

Checks

These checks pass on the head:

• uv run pytest: 2487 passed, 7 skipped
• uv run pre-commit run --all-files
• uv run mypy src --strict
• uv run systemap refresh
• uv run systemap check
• uv run systemap judgement: no open findings, 16 current reviews

The official ASD-STE100 dictionary was not available. A maintainer must examine the words of the new text.

---

Generated by Claude Code

[github-actions]

Architecture

• Contract: no change
• Map: 3 changed components
  • changed component CLI (description): examined, source review current
  • changed component Router (modules): examined, source review current
  • changed component SecondOpinion (description): examined, source review current
• Rules: none

Levels: established = the facts show the claim. examined = an agent or a person examined the cited source. unknown = the facts and the source reviews do not show the claim.