open/config-audit
1
0
Fork 0
Code Issues Releases 1 Activity

docs(plan): v5.4.0 Session A — reconciliation + ship-list GO (Option A) [skip-docs]

Browse source 
Re-verified the 6 deferred v5.4 candidates against HEAD on two axes (code-state +
CC premise, primary-source where risky). Operator GO "Option A": ship #1 PLH
shadow-folder + #5 PLH skills:-array + #4 autoMode structure/dead-config; no new
scanner (badge stays 13). #2 acceptEdits-writes + #6 nested-.claude deferred; #3
Read-deny/Glob-Grep WONTFIX — premise refuted by code.claude.com/docs (Read deny
already covers Glob/Grep), matrix row 175 was framed backwards and is now fixed.

- New: docs/v5.4.0-release-plan.md (Session A→C, mirrors v5.3.0 structure)
- Updated: docs/cc-2.1.x-gap-matrix.md (## v5.4.0 reconciliation block + row-175 fix)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
This commit is contained in:
Kjell Tore Guttormsen 2026-06-19 21:24:58 +02:00
commit c6992cad57
2 changed files with 266 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
docs/cc-2.1.x-gap-matrix.md
View file

@ -10,6 +10,34 @@
> `.mcp.json`-dokumentasjon FØR endring — agenten kan ta feil i begge retninger. Manuelt forhåndsverifisert av
> hovedkontekst: `xhigh` (settings-validator.mjs:66), manglende hook-events, 4.7-hardkoding, feature-evolution v2.1.111.
## v5.4.0 reconciliation (2026-06-19 — supersedes the v5.3.0 block + rows below)
The six M-effort candidates deferred at v5.3.0 were re-verified against HEAD (`fe686b6`) on both
axes: **code-state** (still open?) and **CC premise** (real? — primary-source where risky).
See `docs/v5.4.0-release-plan.md` for the full per-candidate evidence.
**Operator GO 2026-06-19: "Option A"** → ship #1, #5, #4. No new scanner (badge stays 13).
| # | Candidate (row) | Code-state @HEAD | CC premise | Verdict |
|---|---|---|---|---|
| 1 | PLH shadow-folder (164) | OPEN (parses only name/desc/version) | CONFIRMED ~2.1.140 | **ship-5.4** → `CA-PLH-015` |
| 5 | PLH `skills:`-array dirs (165) | OPEN (no `parsed.skills` read) | CONFIRMED ~2.1.145 `plugin validate` | **ship-5.4** → `CA-PLH-016` |
| 4 | autoMode.hard_deny structure (179) | OPEN (key known, no nested val) | CONFIRMED (primary source) | **ship-5.4** → `CA-SET-NNN` |
| 2 | acceptEdits-writes shell/build (176) | OPEN (0 matches) | CONFIRMED ~2.1.160, file-list unpinned | **defer** (needs primary-source field list) |
| 6 | nested-.claude closest-wins (139/166) | OPEN (no scanner) | CONFIRMED ~2.1.178 | **defer** (NEW scanner, badge bump → own release) |
| 3 | Read-deny hides Glob/Grep (175) | PARTIAL (`permission-rules.mjs:158-159` hint only) | **REFUTED** by primary source | **wontfix** |
**Row 175 correction (Verifiseringsplikt).** The row was framed **backwards**. The CC permissions
doc states: *"Claude makes a best-effort attempt to apply `Read` rules to all built-in tools that
read files like Grep and Glob"* — so a Read deny **already** covers Glob/Grep. A "Read-deny is
bypassable → false security" finding would be a false positive (same failure mode as the invented
MCP `trust` field). The only real Read-deny bypass is a Bash subprocess (python/node script that
opens files itself), which is documented behavior, not a config mistake. The Windows-path half (CC
normalizes `C:\…` → `/c/…` before matching) is real but narrow/low-value → rolling maintenance.
The L-priority `update-knowledge` rows (env vars, model nuance, hook-output fields, plugin/skill
doc, nested-.claude doc) remain rolling knowledge maintenance — fold in opportunistically.
## v5.3.0 reconciliation (2026-06-19 — supersedes stale rows below)
This matrix was the **v5.2.0** plan. Verified against HEAD (`9b828fa`) during the v5.3.0 Session A