Generated by the improve skill on 2026-09-01 at commit 2d978f84. Each executor must read its plan fully, honor STOP conditions, run every verification gate, and update its status row.
Completed plans are removed from this directory once they land; git history keeps the full documents. Executed so far: 002 (authenticate route-based MCP), 003 (MCP shared-state exposure policy), 004 (remote asset containment), 005 (Data Inspector prototype-chain writes), 006 (authentication-link origin validation), 007 (symlink containment), and the product plan 008 (default-on MCP behind a non-empty agent surface).
| Plan | Title | Priority | Effort | Depends on | Status |
|---|---|---|---|---|---|
| 001 | Pin privileged GitHub Actions dependencies | P1 | S | - | TODO |
Status values: TODO | IN PROGRESS | DONE | BLOCKED (with reason) | REJECTED (with rationale)
Plan 001 has no plan document yet; the finding is that the release path should stop following mutable privileged workflow code (pin action references to commit SHAs in .github/workflows).
- Dependency audit output reported critical/high advisories in
tar,postcss,sharp,svgo,brace-expansion, andnanoid, but review did not establish a reachable vulnerable runtime or distribution path. Reassess when dependency call paths or advisory conditions change. - Open Graph private-address fetching matches a tool whose purpose includes inspecting local development URLs; no separate private-network boundary is currently documented.
- Code-server workspace selection is an explicit tool input, so arbitrary folder selection alone was not treated as a containment bypass.
- Bearer-token expiration and static-token revocation behavior are lifecycle policy choices rather than implementation bypasses under the documented model.
- Executable asset formats share the user app's development trust boundary; the audit did not establish a distinct origin boundary that the current behavior violates.
This was a standard-effort, hotspot-weighted security audit of core RPC/auth/transports, hub browser boundaries, built-in devframes, framework kits, CI, starter, and representative examples. It did not audit correctness, performance, general test coverage, architecture, documentation quality, or product direction. Findings selected for plans were 1-6 plus the MCP shared-state dependency identified as finding 8.