PLAN § v8.1.3 tillegg b and c.
- b: scanner-reference.md said Knowledge Files (20); knowledge/ holds
22. Added typosquat-allowlist.json and workflow-injection-patterns.md;
the test pins header and table to the directory.
- c: ci-cd-guide.md claimed zero network calls, OSV opt-in and "no
cross-border data transfer". Measured in the code: dep runs npm audit
(package.json) and pip-audit (requirements.txt, if installed), network
resolves found domains over DNS, supply-chain queries OSV.dev, none
with a switch. The guide now says so. scanner-reference.md carried the
same claim plus a `--online` flag that does not exist (0 hits in
scanners/); fixed in the same commit because the same gate covers it
(chosen over leaving a known-false line in a file already edited here).
That extra check was red on fd7de23's text, verified.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kjell Tore Guttormsen
b4d9f83521