P0 whole-implementation review

Review date: 23 October 2026. Executable baseline: 460f7245352e5d1e407d37e9d40a9b2b6b55ee0a. Architecture-plan commit d1fceb23 changes documentation only.

Status: source review completed; six initial findings corrected in #178, with three additional dependency/toolchain corrections from the post-merge alert refresh and stable-component check. Candidate acceptance and publication remain bound to exact pull-request checks and deployment receipts. This is a risk-based integration review of the whole implementation, not an exhaustive line-by-line audit or certification.

Scope and method

Follow the P0 architecture plan: inventory first-party executable material, review entry points and trust boundaries, compare contracts and tests, reproduce defects, add regression checks and run affected assurance planes. Two independent automated review passes cover the engine/transports and remaining source/build/Reader boundaries. The lead also reviews and implements corrections. Requested independent-review settings were GPT-6 Luna, Medium; actual resolved settings were not exposed by the review tools.

The coverage inventory records baseline hashes, component responsibilities, review depth, findings and exclusions. Inventory membership does not imply independent review of every line.

Findings and corrections

R1 — Redirected evidence requests and stalled workbench loads

Priority: P2. Affects workbench.ts, readingHelp.ts and passages.ts under apps/okf-explorer/src/lib/evidence.

These loaders checked a changed response URL after the browser had followed a redirect. An admitted URL could therefore contact an unadmitted destination before rejection. Workbench loads also lacked their own deadline, allowing a stalled response to leave the interface waiting indefinitely.

Correction: use redirect: 'error' in all three loaders and combine a 15-second workbench deadline with caller cancellation. Preserve byte ceilings, identity checks and stream cancellation. Tests exercise the production loader calls, redirect options, timeout and caller abort.

R2 — Compatibility worker deletes unrelated origin caches

Priority: P2. Affects explorer/service-worker.js.

Activation deleted every origin cache except its fixed current name. Other applications sharing the GitHub Pages origin could lose offline data. Fallback also searched across origin caches; failed cache writes could produce an unhandled rejection.

Correction: namespace caches by worker registration scope, delete only older entries in that namespace and use only that cache for fallback. Preserve unrelated and historical unscoped caches. Wait for writes and handle storage failure without failing a successful network response. Executable worker tests cover activation, offline isolation, cache misses and write failures.

R3 — Invalid saved pins stop compatibility startup

Priority: P2. Affects explorer/app.js.

The top-level initialiser parsed local storage without error handling and passed its value directly to Set. Malformed JSON, a non-iterable value or storage-access failure stopped startup before bundle loading. Non-string entries could break later pin processing.

Correction: read defensively, require an array and retain only strings. Tests execute production initialisation against malformed, wrong-shaped, mixed-type and unavailable storage.

R4 — Source text can terminate the embedded viewer script

Priority: P1. Affects scripts/update_viewer.py and generated viewer.html.

The generator inserted JSON containing Markdown bodies directly into an HTML script element. JSON quoting does not stop the HTML parser recognising a closing script tag. Imported or authored source text containing that sequence could escape its data context when the generated viewer opened.

Correction: escape HTML-significant characters and JavaScript line separators before embedding. The regression includes mixed-case closing tags, an injected script, separators and a pound sign; decoding must recover the exact original graph. Regenerate the viewer through its authoritative script.

R5 — Affected Zod version in the service lockfile

Priority: P1 dependency remediation. Affects the remote service package and lockfile. A fresh audit reported the high-severity Zod resource-consumption advisory against 4.6.5; the advisory lists 4.6.6 as patched. This review does not demonstrate a service exploit or override its existing request limits.

Correction: pin compatible 4.6.7, preserve other dependencies and source/engine identities, rebuild and run both SDK generations and Worker checks. The post-update audit reports no known vulnerabilities. This source merge does not redeploy the independently hosted service; its deployment record retains its original scope.

R6 — Python lockfile retains versions affected by 44 alerts

Priority: P1 dependency remediation. GitHub reported 44 open version alerts against uv.lock, covering Pillow, certifi, multidict and urllib3, including critical and high severities. These are dependency advisories, not a claim that this review exploited the application. See the bounded alert and version comparison.

Correction: allow Pillow 13 in the development dependency group and update only those four locked packages. Retain CPython 3.12.11, uv 0.12.2 and the other resolved dependencies. Keep multidict on its patched 6.x line. Declare resolution constraints and test the reviewed minimum versions so a later lock refresh cannot silently reintroduce these versions. Rerun deterministic Python and publication checks; current-head CI remains the merge gate.

The Pillow 13 release notes and the certifi, multidict and urllib3 advisories support the reviewed update boundaries. The comparison covers the retained alert set; GitHub's default-branch alert state updates separately after merge.

Assurance and release gate

Post-merge dependency refresh

GitHub closed all 44 Python alerts after #178 merged as abc26ef2fef55bcc63f5e6ceb04d781f13c01654. Its refreshed graph then exposed eight additional low/moderate JavaScript alert records. These represent two SvelteKit advisories duplicated across the manifest and lockfile, and four fast-uri advisories. They are recorded separately from the initial inventory.

R7 — SvelteKit dependency, P2: upgrade 2.70.3 to stable 3.1.0 and static adapter 4.0.0. The 3.1 release is the current npm latest; it includes the fixes first released in 3.0.0. The enhanced-form redirect advisory and prerender header advisory have no established trigger in authored Explorer code: it uses neither enhanced form actions nor untrusted cache-control headers. Apply the upstream package correction regardless. Follow the official migration guide: move settings into Vite, extend the framework type configuration and declare the existing source alias explicitly. Preserve adapter settings, relative paths, prerender exceptions and deterministic version identity. Set deployment polling to zero to preserve the earlier behaviour. Keep the existing Node release lines and application TypeScript 6; select compatible Svelte, Vite and checker patches through the stable-component review. Replace the broad cookie override with a conditional floor so Kit 3 uses its required cookie 2.0.1 dependency.

R8 — fast-uri dependency, P2: update only the service lockfile's development-only 3.1.8 to patched 3.1.9. The legacy test SDK reaches it through Ajv; production service source does not import it, and the Worker build excludes that provider. The upstream advisories cover scheme decoding, relative paths, host canonicalisation and suffix references. Preserve its development-only scope and existing immutable engine/source pairs.

R9 — Older CI Node pin, P1 dependency remediation: the release-currency check found three jobs pinned to Node 26.7.0, behind the October Node security releases. Pin those jobs to 26.12.1 and the existing Node 24 jobs to 24.22.1 LTS. Preserve the two release lines, workflow permissions and Ubuntu latest. This is CI runtime remediation; it does not attest to a changed hosted MCP runtime or demonstrate an application exploit. Pin the current pnpm 10 patch to 10.34.7 in the manifest and workflows for consistent validation.

The bounded stable-component comparison records the other current releases, compatible patches and retained governance pins. Python/uv policy changes, newer test/compiler majors and the coupled MCP refresh remain proposed maintenance, with their own acceptance criteria.

An independent read-only pass checked applicability and migration boundaries. The follow-up retains the same current-head checks and exact-deployment gate. Retain its eight alert records and preceding browser evidence alongside the refreshed application-bound receipt.

Candidate validation

Targeted regressions cover all corrections. Engine controls, archive tests, application and Python contracts, deterministic builds, service tests and the selected browser/Foundry jobs provide wider integration evidence. Exact candidate outcomes belong to the pull-request checks and retained CI artefacts; a list of required checks is not a claim they passed.

Preserve the previous Heritage candidate receipt and compressed results byte for byte. Refresh the 100-question browser suite and three local journeys against the new assembled application, then materialise its build-bound receipt. Source snapshot dates and historical failures remain intact.

Merge only after every required current-head check passes. Then verify the exact deployed commit, identity and intended journey in a real browser. A failure remains a blocker. Static-site and independent MCP-service deployments are separate operations.

No unresolved critical or high first-party code finding was identified in the reviewed boundaries after correction. Residual limits are explicit: lines outside the selected boundary paths, upstream/vendored code, independently owned corpora, live providers, restricted-data controls, domain/legal acceptance, human accessibility and current AI-host/Voice compatibility. Those remain separate P1–P3 or producer assurance work.